CVE-2026-0637: When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without…

PriorityP421medium4.4CVSS 3.1

AVLACLPRHUINSUCHINAN

EPSS

0.16%

5.0th percentile

When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values. A malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information, such as user credentials or other confidential data, that was inadvertently logged due to misconfiguration, potentially leading to unauthorized access.

Affected

62 ranges· showing 25

Vendor	Product	Version range	Fixed in
wso2	api_control_plane	>= 4.5.0 < 4.5.0.50	4.5.0.50
wso2	api_control_plane	>= 4.6.0 < 4.6.0.14	4.6.0.14
wso2	api_manager	>= 3.1.0 < 3.1.0.357	3.1.0.357
wso2	api_manager	>= 3.2.0 < 3.2.0.465	3.2.0.465
wso2	api_manager	>= 3.2.1 < 3.2.1.84	3.2.1.84
wso2	api_manager	>= 4.1.0 < 4.1.0.249	4.1.0.249
wso2	api_manager	>= 4.2.0 < 4.2.0.189	4.2.0.189
wso2	api_manager	>= 4.3.0 < 4.3.0.100	4.3.0.100
wso2	api_manager	>= 4.4.0 < 4.4.0.64	4.4.0.64
wso2	api_manager	>= 4.5.0 < 4.5.0.49	4.5.0.49
wso2	api_manager	>= 4.6.0 < 4.6.0.13	4.6.0.13
wso2	identity_server	>= 5.10.0 < 5.10.0.386	5.10.0.386
wso2	identity_server	>= 5.11.0 < 5.11.0.433	5.11.0.433
wso2	identity_server	>= 6.0.0 < 6.0.0.260	6.0.0.260
wso2	identity_server	>= 6.1.0 < 6.1.0.261	6.1.0.261
wso2	identity_server_as_key_manager	>= 5.10.0 < 5.10.0.377	5.10.0.377
wso2	open_banking_am	>= 2.0.0 < 2.0.0.406	2.0.0.406
wso2	open_banking_iam	>= 2.0.0 < 2.0.0.426	2.0.0.426
wso2	traffic_manager	>= 4.5.0 < 4.5.0.48	4.5.0.48
wso2	traffic_manager	>= 4.6.0 < 4.6.0.13	4.6.0.13
wso2	universal_gateway	>= 4.5.0 < 4.5.0.49	4.5.0.49
wso2	universal_gateway	>= 4.6.0 < 4.6.0.13	4.6.0.13
wso2	wso2_api_control_plane	>= 4.5.0 < 4.5.0.50	4.5.0.50
wso2	wso2_api_control_plane	>= 4.6.0 < 4.6.0.14	4.6.0.14
wso2	wso2_api_manager	>= 3.1.0 < 3.1.0.357	3.1.0.357

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.