#wso2

Analysis · May 20, 2026 · Colten Anderson

WSO2 CVE-2022-29464: an upload bug on the box that brokers your APIs and logins

CVE-2022-29464 is an unauthenticated file-upload-to-RCE in WSO2 products. The bug is a familiar one. What makes it serious is where it lives: API management and identity middleware that sits in front of your services and authenticates your users.