{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-15039","assignerOrgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","state":"PUBLISHED","assignerShortName":"WSO2","dateReserved":"2025-12-23T08:27:22.275Z","datePublished":"2026-08-06T07:33:23.097Z","dateUpdated":"2026-08-06T12:31:43.779Z"},"containers":{"cna":{"providerMetadata":{"orgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","shortName":"WSO2","dateUpdated":"2026-08-06T07:33:23.097Z"},"title":"Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-693","description":"CWE-693: Protection Mechanism Failure","type":"CWE"}]}],"impacts":[{"capecId":"CAPEC-134","descriptions":[{"lang":"en","value":"CAPEC-134 CAPEC-134: Circumventing Security Controls"}]}],"affected":[{"vendor":"WSO2","product":"WSO2 Identity Server","versions":[{"status":"unknown","version":"0","lessThan":"5.7.0","versionType":"custom"},{"status":"affected","version":"5.7.0","lessThan":"5.7.0.130","versionType":"custom"},{"status":"affected","version":"5.8.0","lessThan":"5.8.0.113","versionType":"custom"},{"status":"affected","version":"5.9.0","lessThan":"5.9.0.173","versionType":"custom"},{"status":"affected","version":"5.10.0","lessThan":"5.10.0.385","versionType":"custom"},{"status":"affected","version":"5.11.0","lessThan":"5.11.0.432","versionType":"custom"},{"status":"affected","version":"6.0.0","lessThan":"6.0.0.259","versionType":"custom"},{"status":"affected","version":"6.1.0","lessThan":"6.1.0.260","versionType":"custom"},{"status":"affected","version":"7.0.0","lessThan":"7.0.0.138","versionType":"custom"},{"status":"affected","version":"7.1.0","lessThan":"7.1.0.45","versionType":"custom"},{"status":"affected","version":"7.1.0","lessThan":"7.1.0.49","versionType":"custom"},{"status":"affected","version":"7.2.0","lessThan":"7.2.0.7","versionType":"custom"}],"defaultStatus":"unaffected"},{"vendor":"WSO2","product":"WSO2 API Manager","versions":[{"status":"unknown","version":"0","lessThan":"2.6.0","versionType":"custom"},{"status":"affected","version":"2.6.0","lessThan":"2.6.0.150","versionType":"custom"},{"status":"affected","version":"3.0.0","lessThan":"3.0.0.180","versionType":"custom"},{"status":"affected","version":"3.1.0","lessThan":"3.1.0.356","versionType":"custom"},{"status":"affected","version":"3.2.0","lessThan":"3.2.0.460","versionType":"custom"},{"status":"affected","version":"3.2.1","lessThan":"3.2.1.79","versionType":"custom"},{"status":"affected","version":"4.0.0","lessThan":"4.0.0.381","versionType":"custom"},{"status":"affected","version":"4.1.0","lessThan":"4.1.0.244","versionType":"custom"},{"status":"affected","version":"4.2.0","lessThan":"4.2.0.184","versionType":"custom"},{"status":"affected","version":"4.3.0","lessThan":"4.3.0.95","versionType":"custom"},{"status":"affected","version":"4.4.0","lessThan":"4.4.0.59","versionType":"custom"},{"status":"affected","version":"4.5.0","lessThan":"4.5.0.44","versionType":"custom"},{"status":"affected","version":"4.6.0","lessThan":"4.6.0.8","versionType":"custom"}],"defaultStatus":"unaffected"},{"vendor":"WSO2","product":"WSO2 Open Banking AM","versions":[{"status":"unknown","version":"0","lessThan":"1.4.0","versionType":"custom"},{"status":"affected","version":"1.4.0","lessThan":"1.4.0.143","versionType":"custom"},{"status":"affected","version":"1.5.0","lessThan":"1.5.0.144","versionType":"custom"},{"status":"affected","version":"2.0.0","lessThan":"2.0.0.405","versionType":"custom"}],"defaultStatus":"unaffected"},{"vendor":"WSO2","product":"WSO2 Open Banking IAM","versions":[{"status":"unknown","version":"0","lessThan":"2.0.0","versionType":"custom"},{"status":"affected","version":"2.0.0","lessThan":"2.0.0.425","versionType":"custom"}],"defaultStatus":"unaffected"},{"vendor":"WSO2","product":"WSO2 Traffic Manager","versions":[{"status":"unknown","version":"0","lessThan":"4.5.0","versionType":"custom"},{"status":"affected","version":"4.5.0","lessThan":"4.5.0.43","versionType":"custom"},{"status":"affected","version":"4.6.0","lessThan":"4.6.0.8","versionType":"custom"}],"defaultStatus":"unaffected"},{"vendor":"WSO2","product":"WSO2 Universal Gateway","versions":[{"status":"affected","version":"4.5.0","lessThan":"4.5.0.43","versionType":"custom"},{"status":"affected","version":"4.5.0","lessThan":"4.5.0.44","versionType":"custom"},{"status":"affected","version":"4.6.0","lessThan":"4.6.0.8","versionType":"custom"}],"defaultStatus":"unaffected"},{"vendor":"WSO2","product":"WSO2 API Control Plane","versions":[{"status":"affected","version":"4.5.0","lessThan":"4.5.0.45","versionType":"custom"},{"status":"affected","version":"4.6.0","lessThan":"4.6.0.9","versionType":"custom"}],"defaultStatus":"unaffected"},{"vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","versions":[{"status":"unknown","version":"0","lessThan":"5.7.0","versionType":"custom"},{"status":"affected","version":"5.7.0","lessThan":"5.7.0.129","versionType":"custom"},{"status":"affected","version":"5.9.0","lessThan":"5.9.0.179","versionType":"custom"},{"status":"affected","version":"5.10.0","lessThan":"5.10.0.376","versionType":"custom"}],"defaultStatus":"unaffected"},{"vendor":"WSO2","product":"WSO2 Open Banking KM","versions":[{"status":"unknown","version":"0","lessThan":"1.4.0","versionType":"custom"},{"status":"affected","version":"1.4.0","lessThan":"1.4.0.137","versionType":"custom"},{"status":"affected","version":"1.5.0","lessThan":"1.5.0.127","versionType":"custom"}],"defaultStatus":"unaffected"},{"vendor":"WSO2","product":"WSO2 Carbon Identity Application Authentication Framework","packageName":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework","versions":[{"status":"affected","version":"5.12.153","lessThan":"5.12.153.66","versionType":"custom"},{"status":"affected","version":"5.12.387","lessThan":"5.12.387.48","versionType":"custom"},{"status":"affected","version":"5.14.97","lessThan":"5.14.97.94","versionType":"custom"},{"status":"affected","version":"5.17.5","lessThan":"5.17.5.337","versionType":"custom"},{"status":"affected","version":"5.17.118","lessThan":"5.17.118.24","versionType":"custom"},{"status":"affected","version":"5.18.187","lessThan":"5.18.187.334","versionType":"custom"},{"status":"affected","version":"5.18.248","lessThan":"5.18.248.34","versionType":"custom"},{"status":"affected","version":"5.23.8","lessThan":"5.23.8.221","versionType":"custom"},{"status":"affected","version":"5.24.8","lessThan":"5.24.8.29","versionType":"custom"},{"status":"affected","version":"5.25.92","lessThan":"5.25.92.177","versionType":"custom"},{"status":"affected","version":"5.25.705","lessThan":"5.25.705.23","versionType":"custom"},{"status":"affected","version":"5.25.713","lessThan":"5.25.713.12","versionType":"custom"},{"status":"affected","version":"5.25.724","lessThan":"5.25.724.8","versionType":"custom"},{"status":"affected","version":"5.25.736","lessThan":"5.25.736.3","versionType":"custom"},{"status":"affected","version":"7.0.78","lessThan":"7.0.78.171","versionType":"custom"},{"status":"affected","version":"7.8.23","lessThan":"7.8.23.95","versionType":"custom"},{"status":"affected","version":"7.8.586","lessThan":"7.8.586.21","versionType":"custom"},{"status":"unaffected","version":"5.25.738","lessThanOrEqual":"5.25.*","versionType":"custom"},{"status":"unaffected","version":"7.8.646","lessThanOrEqual":"*","versionType":"custom"}],"defaultStatus":"unknown"}],"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7.0","versionEndExcluding":"5.7.0.130"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8.0","versionEndExcluding":"5.8.0.113"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9.0","versionEndExcluding":"5.9.0.173"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.0","versionEndExcluding":"5.10.0.385"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11.0","versionEndExcluding":"5.11.0.432"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.0.0.259"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.0","versionEndExcluding":"6.1.0.260"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.0.0.138"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1.0","versionEndExcluding":"7.1.0.45"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1.0","versionEndExcluding":"7.1.0.49"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionStartIncluding":"7.2.0","versionEndExcluding":"7.2.0.7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.0","versionEndExcluding":"2.6.0.150"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"3.0.0.180"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"3.1.0","versionEndExcluding":"3.1.0.356"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2.0","versionEndExcluding":"3.2.0.460"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2.1","versionEndExcluding":"3.2.1.79"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.0.381"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.0.244"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.0.184"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.0.95"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"4.4.0","versionEndExcluding":"4.4.0.59"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5.0","versionEndExcluding":"4.5.0.44"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6.0","versionEndExcluding":"4.6.0.8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*","versionStartIncluding":"1.4.0","versionEndExcluding":"1.4.0.143"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*","versionStartIncluding":"1.5.0","versionEndExcluding":"1.5.0.144"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"2.0.0.405"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"2.0.0.425"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5.0","versionEndExcluding":"4.5.0.43"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6.0","versionEndExcluding":"4.6.0.8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5.0","versionEndExcluding":"4.5.0.43"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5.0","versionEndExcluding":"4.5.0.44"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6.0","versionEndExcluding":"4.6.0.8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5.0","versionEndExcluding":"4.5.0.45"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6.0","versionEndExcluding":"4.6.0.9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7.0","versionEndExcluding":"5.7.0.129"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9.0","versionEndExcluding":"5.9.0.179"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.0","versionEndExcluding":"5.10.0.376"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_open_banking_km:*:*:*:*:*:*:*:*","versionStartIncluding":"1.4.0","versionEndExcluding":"1.4.0.137"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_open_banking_km:*:*:*:*:*:*:*:*","versionStartIncluding":"1.5.0","versionEndExcluding":"1.5.0.127"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12.153","versionEndExcluding":"5.12.153.66"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12.387","versionEndExcluding":"5.12.387.48"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14.97","versionEndExcluding":"5.14.97.94"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*","versionStartIncluding":"5.17.5","versionEndExcluding":"5.17.5.337"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*","versionStartIncluding":"5.17.118","versionEndExcluding":"5.17.118.24"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18.187","versionEndExcluding":"5.18.187.334"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18.248","versionEndExcluding":"5.18.248.34"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*","versionStartIncluding":"5.23.8","versionEndExcluding":"5.23.8.221"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*","versionStartIncluding":"5.24.8","versionEndExcluding":"5.24.8.29"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*","versionStartIncluding":"5.25.92","versionEndExcluding":"5.25.92.177"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*","versionStartIncluding":"5.25.705","versionEndExcluding":"5.25.705.23"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*","versionStartIncluding":"5.25.713","versionEndExcluding":"5.25.713.12"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*","versionStartIncluding":"5.25.724","versionEndExcluding":"5.25.724.8"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*","versionStartIncluding":"5.25.736","versionEndExcluding":"5.25.736.3"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.78","versionEndExcluding":"7.0.78.171"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*","versionStartIncluding":"7.8.23","versionEndExcluding":"7.8.23.95"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*","versionStartIncluding":"7.8.586","versionEndExcluding":"7.8.586.21"},{"vulnerable":false,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*","versionStartIncluding":"5.25.738","versionEndIncluding":"5.25.*"},{"vulnerable":false,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*","versionStartIncluding":"7.8.646","versionEndIncluding":"*"}]}]}],"descriptions":[{"lang":"en","value":"The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps.\n\nSuccessful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.","supportingMedia":[{"type":"text/html","base64":false,"value":"The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps.\n\nSuccessful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps."}]}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4973/","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW","baseSeverity":"CRITICAL","baseScore":9.4,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"}}],"solutions":[{"lang":"en","value":"Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4973/#solution","supportingMedia":[{"type":"text/html","base64":false,"value":"<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4973/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4973/#solution</span></a> <br>"}]}],"source":{"advisory":"WSO2-2025-4973","discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-06T12:31:35.881685Z","id":"CVE-2025-15039","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-06T12:31:43.779Z"}}]}}