Answer in brief
CVE-2025-7203 records a Medium severity (CVSS 4.9) vulnerability in Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials. The current sources do not mark it as known exploited. The current feed maps WSO2/WSO2 API Control Plane (generic), WSO2/WSO2 API Manager (generic), WSO2/WSO2 Carbon Identity API Server Configs V1 (generic), WSO2/WSO2 Carbon Logging Services (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 4.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps WSO2/WSO2 API Control Plane (generic), WSO2/WSO2 API Manager (generic), WSO2/WSO2 Carbon Identity API Server Configs V1 (generic), WSO2/WSO2 Carbon Logging Services (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| WSO2/WSO2 API Control Planegeneric | >=4.5.0 <4.5.0.47 || >=4.6.0 <4.6.0.15 | 4.5.0.47, 4.6.0.15 |
| WSO2/WSO2 API Managergeneric | >=4.3.0 <4.3.0.97 || >=4.4.0 <4.4.0.61 || >=4.5.0 <4.5.0.46 || >=4.6.0 <4.6.0.14 | 4.3.0.97, 4.4.0.61, 4.5.0.46, 4.6.0.14 |
| WSO2/WSO2 Carbon Identity API Server Configs V1generic | >=1.2.176 <1.2.176.16 || >=1.3.83 <1.3.83.7 | 1.2.176.16, 1.3.83.7 |
| WSO2/WSO2 Carbon Logging Servicesgeneric | >=4.9.11 <4.9.11.4 || >=4.9.18 <4.9.18.2 || >=4.10.9 <4.10.9.2 || >=4.10.19 <4.10.19.1 | 4.9.11.4, 4.9.18.2, 4.10.9.2, 4.10.19.1 |
| WSO2/WSO2 Carbon Secured HTTP Log4j2 Appendergeneric | >=4.9.11 <4.9.11.4 || >=4.9.18 <4.9.18.2 || >=4.10.9 <4.10.9.2 || >=4.10.19 <4.10.19.1 | 4.9.11.4, 4.9.18.2, 4.10.9.2, 4.10.19.1 |
| WSO2/WSO2 Identity Servergeneric | >=7.0.0 <7.0.0.111 || >=7.1.0 <7.1.0.19 | 7.0.0.111, 7.1.0.19 |
| WSO2/WSO2 Traffic Managergeneric | >=4.5.0 <4.5.0.45 || >=4.6.0 <4.6.0.14 | 4.5.0.45, 4.6.0.14 |
| WSO2/WSO2 Universal Gatewaygeneric | >=4.5.0 <4.5.0.46 || >=4.6.0 <4.6.0.14 | 4.5.0.46, 4.6.0.14 |
Published upstream
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 19, 2026
The Management Console and product files expose sensitive data, including remote log server credentials, truststore passwords, and keystore passwords, in plain text. This occurs because the system does not sufficiently protect or obscure these credentials when the remote logging feature is enabled. An attacker with administrative access to the Management Console or direct access to product files can retrieve these sensitive credentials. This allows for potential manipulation of log entries and compromise of the integrity and confidentiality of the remote log server.
Quoted source text, attributed separately from HOL analysis.