Our takeCISA added CVE-2026-5430 (WSO2 API Manager, API Control Plane, Traffic Manager, Universal Gateway path traversal) to KEV. It is actively exploited and can lead to RCE via unrestricted file upload. Patch per vendor guidance now.Security Resilience desk
Sources (7)
- cisa_kev · cisa_kev
- cisa_advisories · cisa_advisories
- hackernews · hackernews
- hackread · hackread
- cisa_advisories · cisa_advisories
- helpnet · helpnet
- hackernews · hackernews
What this means for you — Security leader:CISA added CVE-2026-5430 (WSO2 API Control Plane, API Manager, Traffic Manager, Universal Gateway path traversal) to KEV. Update to a fixed version or apply vendor mitigations immediately; this is confirmed exploited in the wild.
What this means for you — Lean IT orgs:If you run any WSO2 API products, update them now or follow the vendor's fix instructions. Most lean-IT teams without these products can ignore this one.
What this means for you — MSP:Check client environments for WSO2 API Control Plane, API Manager, Traffic Manager or Universal Gateway. Apply the vendor patch or mitigations as soon as possible; exploitation is confirmed.
What this means for you — Researcher:CISA added CVE-2026-5430 (WSO2 path traversal leading to unrestricted file upload and RCE) to KEV based on confirmed in-the-wild exploitation.