CVE-2026-3416

Estado: AnalizadaAlta (7.5)—

The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables malicious actors to forge event payloads with valid HMAC signatures, bypassing the API Gateway's authenticity verification.

Successful exploitation could allow an attacker to predict shared secrets used for Webhook HMAC validation and forge event payloads with valid signatures. This may enable bypassing API Gateway authenticity checks, leading to unauthorized event injection, data manipulation, or downstream system compromise.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Puntuación base: 7.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.36%
Percentil entre todas las CVEs puntuadas: 27
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access85 %
Impacto principalT1565.002 Transmitted Data Manipulationimpact80 %
Impacto secundarioT1548.002 Bypass User Account Controlprivilege escalation70 %

PRNG débil en secretos HMAC (CWE-330) permite predecir credenciales y forjar payloads válidos en API expuesta (AV:N,PR:N). Impactos: manipulación de datos por inyección de eventos falsificados y potencial escalada por autenticación comprometida en gateway.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Update Software Vulnerability Scanning Network Segmentation Limit Access to Resource Over Network Filter Network Traffic

Tecnologías afectadas (2)

Wso2 — API Control Plane Wso2 — API Manager

CWE

CWE-330

Referencias

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5174/

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-3416",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-3416",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-03T12:55:07.421469Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
      "affectedData": [
        {
          "vendor": "WSO2",
          "product": "WSO2 API Manager",
          "versions": [
            {
              "status": "unknown",
              "version": "0",
              "lessThan": "4.1.0",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "4.1.0",
              "lessThan": "4.1.0.253",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "4.2.0",
              "lessThan": "4.2.0.193",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "4.3.0",
              "lessThan": "4.3.0.104",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "4.4.0",
              "lessThan": "4.4.0.68",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "4.5.0",
              "lessThan": "4.5.0.52",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "WSO2",
          "product": "WSO2 API Control Plane",
          "versions": [
            {
              "status": "affected",
              "version": "4.5.0",
              "lessThan": "4.5.0.53",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-09-03T13:05:37.847",
  "references": [
    {
      "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5174/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
      "description": [
        {
          "lang": "en",
          "value": "CWE-330"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables malicious actors to forge event payloads with valid HMAC signatures, bypassing the API Gateway's authenticity verification.\n\nSuccessful exploitation could allow an attacker to predict shared secrets used for Webhook HMAC validation and forge event payloads with valid signatures. This may enable bypassing API Gateway authenticity checks, leading to unauthorized event injection, data manipulation, or downstream system compromise."
    }
  ],
  "lastModified": "2026-09-15T18:02:04.233",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0FEB4245-50CD-43FC-AE9B-FBF02739B4AC",
              "versionEndExcluding": "4.5.0.53",
              "versionStartIncluding": "4.5.0"
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "65F7A6AE-FEE8-4B9E-8CAF-6F49AA939553",
              "versionEndExcluding": "4.1.0.253",
              "versionStartIncluding": "4.1.0"
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "818A1209-F67E-40B3-BF10-B890E3AD8A63",
              "versionEndExcluding": "4.2.0.193",
              "versionStartIncluding": "4.2.0"
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C8B78FF-DD1F-4C94-81DB-27A98EFA559B",
              "versionEndExcluding": "4.3.0.104",
              "versionStartIncluding": "4.3.0"
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "86F14FD5-7766-469C-9D7D-318DF9089635",
              "versionEndExcluding": "4.4.0.68",
              "versionStartIncluding": "4.4.0"
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "44B6BFA2-2FD5-4992-9A43-3B44976FDE57",
              "versionEndExcluding": "4.5.0.52",
              "versionStartIncluding": "4.5.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"
}