WSO2 Multiple Products Path Traversal Vulnerability Added to CISA KEV

What's on the official record

CISA added CVE-2026-5430, a path traversal vulnerability in WSO2 API Control Plane, API Manager, Traffic Manager and Universal Gateway, to its Known Exploited Vulnerabilities Catalog. The vulnerability could allow for unrestricted file upload and lead to remote code execution. CISA records CWE-347, a dateAdded of 24 September 2026, a dueDate of 27 September 2026, and catalogVersion 2026.10.21. The catalog does not record known ransomware use. The CVE record names the fix as fixed in 4.5.0.57 and fixed in 4.6.0.21 for WSO2 Universal Gateway. FIRST's EPSS model estimates a score of 0.006 (p47, 2026-10-23). CISA's ADP records SSVC values of exploitation active, automatable yes, and impact total.

Assessment

For a platform or AI-stack owner, the record lets you check whether any WSO2 API Control Plane, API Manager, Traffic Manager or Universal Gateway deployment in your estate runs a Universal Gateway version below 4.5.0.57 or 4.6.0.21, and to patch or pull those versions before the unrestricted file upload path is reachable. CISA's required action is to apply mitigations in accordance with vendor instructions under BOD 26-04.

For a cyber underwriter, the record lets you price or condition coverage on whether an insured has applied the fixed Universal Gateway versions and can evidence the patch state of its WSO2 API and gateway products. CISA's ADP assesses the vulnerability as actively exploited, automatable, and total in impact, which supports requiring a control that confirms the fixed versions are in place.

What would change this call

A vendor advisory naming additional affected or fixed versions, or a change to the CVE record's fix field, would change the patch and pricing guidance above.

What to check next

Confidence

Filed 25 October 2026 from the record dated 24 September 2026.

Sources

[1] WSO2 Multiple Products Path Traversal Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-5430

[2] CVE record CVE-2026-5430 — https://www.cve.org/CVERecord?id=CVE-2026-5430

[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog