A critical XML External Entity (XXE) vulnerability exists in multiple WSO2 products that allows unauthenticated remote attackers to access sensitive system files or cause service disruption.

This vulnerability is caused by improper restriction of XML External Entity (XXE) references (CWE-611). The XML parsers in the affected WSO2 products fail to disable external entity resolution, allowing an unauthenticated attacker to supply malicious XML payloads that can retrieve local files or trigger resource exhaustion.

The vulnerability carries a CVSS score of 7.5, reflecting its high potential for data exposure and service instability. Successful exploitation allows unauthorized parties to read confidential files from the underlying file system, potentially exposing credentials, configuration data, or private keys. Additionally, attackers can leverage this flaw to perform denial of service attacks, which could result in significant operational downtime for critical identity and API management infrastructure.

Immediate Action: Administrators must apply the security updates provided by WSO2 at their official security advisory page (https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3255/).

Proactive Monitoring: Review web server and application access logs for unusual XML payloads, particularly those containing DOCTYPE declarations or external entity references.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect incoming XML traffic and block requests containing suspicious external entity definitions.

Public Exploit Available: exploit_available (false)

Given the severity of potential data exfiltration, organizations utilizing these WSO2 products must prioritize the application of the vendor-supplied patches. Organizations unable to patch immediately should implement strict WAF rules to sanitize XML inputs and restrict access to vulnerable endpoints. Failure to remediate this vulnerability leaves sensitive internal configurations exposed to unauthenticated remote actors.