CVE-2026-2053

CriticalCVSS 10.0/10Last modified Jun 27, 2026

Description

The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated requests.

Successful exploitation allows an unauthenticated attacker to control the destination of server-initiated requests originating from the WSO2 API Manager. This direct control can enable unauthorized access to internal network resources or services that would typically be inaccessible from external networks.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Jun 26, 2026
Last modified
Jun 27, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-205306.7In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malCVE-2026-205318.4In apu, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege with no additional exeCVE-2026-205326.2In apu, there is a possible application crash due to double free. This could lead to local denial of service with no additional execution prCVE-2026-205336.7In display, there is a possible escalation of privilege due to an integer overflow. This could lead to local escalation of privilege if a maCVE-2026-205345.3In Modem, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service, if a UE has CVE-2026-205356.7In aidl, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if CVE-2026-205366.7In aidl, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor CVE-2026-205376.7In aidl, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor CVE-2026-205385.3In Modem, there is a possible out of bounds read due to a missing permission check. This could lead to remote denial of service, if a UE hasCVE-2026-205395.3In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has conCVE-2026-20547.5A security flaw has been discovered in D-Link DIR-605L and DIR-619L 2.06B01/2.13B01. Impacted is an unknown function of the component Wifi SCVE-2026-205405.3In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has con
CVE-2026-2053: Critical severity, CVSS 10.0 | Vulnix