What is CVE-2026-4249?

CVE-2026-4249 is a high-severity vulnerability in Wso2 Api Control Plane, classified under CWE-707. CVSS score: 8.6/10. Published 2026-07-06.

How severe is CVE-2026-4249?

High severity. CVSS v3 base score is 8.6 out of 10.

Vulnerability in Wso2 Api Control Plane

CVE-2026-4249

The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON dat…

CVSS v3 metric

CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H.

Affected products

Wso2 Api Control Plane — versions 4.5.0, 4.6.0, 4.7.0
Wso2 Api Manager — versions 0, 3.2.0, 3.2.1
Wso2 Traffic Manager — versions 4.5.0, 4.6.0, 4.7.0
Wso2 Universal Gateway — versions 4.5.0, 4.6.0, 4.7.0

Weakness classification (CWE)

CWE-707

References

ed10eef1-636d-4fbe-9993-6890dfa878f8 (vendor-advisory)

Frequently asked questions

What is CVE-2026-4249?: CVE-2026-4249 is a high-severity vulnerability in Wso2 Api Control Plane, classified under CWE-707. CVSS score: 8.6/10. Published 2026-07-06.
How severe is CVE-2026-4249?: High severity. CVSS v3 base score is 8.6 out of 10.