CVE-2026-3415
published 2026-08-06CVE-2026-3415: The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the…
PriorityP352high8.7CVSS 3.1
AVNACLPRHUINSCCHINAH
EPSS
0.49%
40.5th percentile
The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges.
Successful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product.
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wso2 | wso2_api_control_plane | >= 4.5.0 < 4.5.0.54 | 4.5.0.54 |
| wso2 | wso2_api_control_plane | >= 4.6.0 < 4.6.0.17 | 4.6.0.17 |
| wso2 | wso2_api_manager | >= 3.2.0 < 3.2.0.472 | 3.2.0.472 |
| wso2 | wso2_api_manager | >= 3.2.1 < 3.2.1.91 | 3.2.1.91 |
| wso2 | wso2_api_manager | >= 4.1.0 < 4.1.0.254 | 4.1.0.254 |
| wso2 | wso2_api_manager | >= 4.2.0 < 4.2.0.194 | 4.2.0.194 |
| wso2 | wso2_api_manager | >= 4.3.0 < 4.3.0.105 | 4.3.0.105 |
| wso2 | wso2_api_manager | >= 4.4.0 < 4.4.0.68 | 4.4.0.68 |
| wso2 | wso2_api_manager | >= 4.5.0 < 4.5.0.53 | 4.5.0.53 |
| wso2 | wso2_api_manager | >= 4.6.0 < 4.6.0.16 | 4.6.0.16 |
| wso2 | wso2_carbon_api_gateway | >= 6.7.206 < 6.7.206.594 | 6.7.206.594 |
| wso2 | wso2_carbon_api_gateway | >= 6.7.210 < 6.7.210.95 | 6.7.210.95 |
| wso2 | wso2_carbon_api_gateway | >= 9.20.74 < 9.20.74.398 | 9.20.74.398 |
| wso2 | wso2_carbon_api_gateway | >= 9.28.116 < 9.28.116.412 | 9.28.116.412 |
| wso2 | wso2_carbon_api_gateway | >= 9.29.120 < 9.29.120.228 | 9.29.120.228 |
| wso2 | wso2_carbon_api_gateway | >= 9.30.67 < 9.30.67.158 | 9.30.67.158 |
| wso2 | wso2_carbon_api_gateway | >= 9.31.86 < 9.31.86.147 | 9.31.86.147 |
| wso2 | wso2_carbon_api_gateway | >= 9.32.147 < 9.32.147.38 | 9.32.147.38 |
| wso2 | wso2_carbon_api_management_implementation | >= 6.7.206 < 6.7.206.594 | 6.7.206.594 |
| wso2 | wso2_carbon_api_management_implementation | >= 6.7.210 < 6.7.210.95 | 6.7.210.95 |
| wso2 | wso2_carbon_api_management_implementation | >= 9.20.74 < 9.20.74.398 | 9.20.74.398 |
| wso2 | wso2_carbon_api_management_implementation | >= 9.28.116 < 9.28.116.412 | 9.28.116.412 |
| wso2 | wso2_carbon_api_management_implementation | >= 9.29.120 < 9.29.120.228 | 9.29.120.228 |
| wso2 | wso2_carbon_api_management_implementation | >= 9.30.67 < 9.30.67.158 | 9.30.67.158 |
| wso2 | wso2_carbon_api_management_implementation | >= 9.31.86 < 9.31.86.147 | 9.31.86.147 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
WSO2 API Control Plane SchemaValidator Mediator resource consumption (WID-SEC-2026-2085)
vuldb·2026-08-07·CVSS 8.7
CVE-2026-3415 [HIGH] WSO2 API Control Plane SchemaValidator Mediator resource consumption (WID-SEC-2026-2085)
A vulnerability categorized as problematic has been discovered in WSO2 API Control Plane, API Gateway, API Manager, Carbon API Gateway, Carbon API Management Implementation, Traffic Manager and Universal Gateway. The impacted element is an unknown function of the component SchemaValidator Mediator. Executing a manipulation can lead to resource consumption.
This vulnerability is registered as CVE-2026-3415. It is possible to launch the attack remotely. No exploit is available.
GHSA
The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows.
ghsa_unreviewed·2026-08-07
CVE-2026-3415 [HIGH] CWE-776 The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows.
The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges.
Successful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption dur
No detection rules found.
No public exploits indexed.
2026-08-06
Published