High severity · published Jul 6, 2026
CVE-2026-4249
Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption
8.6
CVSS
0.6%
EPSS
No
On KEV
Description
The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service condition.
Successful exploitation of this vulnerability can disrupt the API Gateway, preventing legitimate API traffic from being processed and impacting complete service availability. The denial of service is persistent, requiring manual intervention to restore normal operations.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
WSO2 API Control Plane · WSO2
4.5.0 before 4.5.0.55; 4.6.0 before 4.6.0.19; 4.7.0 before 4.7.0.2 · source: vendor
WA
WSO2 API Manager · WSO2
3.2.0 before 3.2.0.470; 3.2.1 before 3.2.1.89; 4.0.0 before 4.0.0.390; 4.1.0 before 4.1.0.254; 4.2.0 before 4.2.0.194; 4.3.0 before 4.3.0.105; +4 more · source: vendor
WT
WSO2 Traffic Manager · WSO2
4.5.0 before 4.5.0.53; 4.6.0 before 4.6.0.18; 4.7.0 before 4.7.0.2 · source: vendor
WU
WSO2 Universal Gateway · WSO2
4.5.0 before 4.5.0.54; 4.6.0 before 4.6.0.18; 4.7.0 before 4.7.0.2 · source: vendor
AC
Api Control Plane · Wso2
4.5.0 before 4.5.0.55; 4.6.0 before 4.6.0.19 · source: NVD
AM
Api Manager · Wso2
4.0.0 before 4.0.0.390; 4.1.0 before 4.1.0.254; 4.2.0 before 4.2.0.194; 4.3.0 before 4.3.0.105; 4.4.0 before 4.4.0.69; 4.5.0 before 4.5.0.54; +1 more · source: NVD
TM
Traffic Manager · Wso2
4.5.0 before 4.5.0.53; 4.6.0 before 4.6.0.18 · source: NVD
UG
Universal Gateway · Wso2
4.5.0 before 4.5.0.54; 4.6.0 before 4.6.0.18 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-4249
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-4249
Vendor Advisory
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5236/
More from WSO2 API Control Plane
10.0
CVE-2026-5430
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
9.8
CVE-2026-1728
Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover
9.4
CVE-2025-15039
Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products
9.1
CVE-2026-3418
Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution
9.0
CVE-2025-14561
Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations