WSO2 Multiple Products Path Traversal Vulnerability

A path traversal vulnerability has been identified in multiple WSO2 products including API Control Plane, API Manager, Traffic Manager, and Universal Gateway. The vulnerability could allow attackers to perform unrestricted file uploads, which may lead to remote code execution. It has been catalogued as CVE-2026-5430 and is listed in CISA's Known Exploited Vulnerabilities. CISA's Binding Operational Directive BOD 26-04 mandates prioritizing security updates based on risk. WSO2 has published a security advisory with remediation guidance. Organizations using affected WSO2 products are urged to apply patches immediately. The vulnerability is rated High severity given its potential for full system compromise via RCE.