Strix
64.9K

CVE-2026-2445

MEDIUMCVSS 6.1/10EPSS 0.15%

Last modified

CVE-2026-2445 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the user's browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. EPSS estimates a 0.15% chance of exploitation in the next 30 days.

Description

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the user's browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. However, the impact is mitigated for session hijacking as all session-related sensitive cookies are protected by the httpOnly flag.

Metrics

CVSS 3.1
6.1/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Probability
0.15%

4.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
Wso2Api Control Plane>= 4.5.0, < 4.5.0.56
Wso2Api Control Plane>= 4.6.0, < 4.6.0.20
Wso2Api Manager>= 4.2.0, < 4.2.0.195
Wso2Api Manager>= 4.3.0, < 4.3.0.106
Wso2Api Manager>= 4.4.0, < 4.4.0.70
Wso2Api Manager>= 4.5.0, < 4.5.0.55
Wso2Api Manager>= 4.6.0, < 4.6.0.19
Wso2Identity Server>= 6.0.0, < 6.0.0.263
Wso2Identity Server>= 6.1.0, < 6.1.0.266
Wso2Identity Server>= 7.0.0, < 7.0.0.144
Wso2Identity Server>= 7.1.0, < 7.1.0.53
Wso2Identity Server>= 7.2.0, < 7.2.0.12

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2026-2445?
The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the user's browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. However, the impact is mitigated for session hijacking as all session-related sensitive cookies are protected by the httpOnly flag.
How severe is CVE-2026-2445?
CVE-2026-2445 has a CVSS score of 6.1/10 (MEDIUM severity). The EPSS model estimates a 0.15% probability of exploitation in the next 30 days.
How do I fix CVE-2026-2445?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-2445?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST