CVE-2026-5430: WSO2 Authentication Bypass Actively Exploited — Detection and Remediation Guide

---
title: WSO2 Java Process Spawning Command Interpreter
description: Detects the WSO2 server Java runtime spawning shells or scripting interpreters, consistent with post-exploitation activity following authentication bypass such as CVE-2026-5430.
id: 3b7c2f91-4a58-4e6d-9c21-8f5d6a7b8c9d
status: experimental
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\java.exe'
      - '\javaw.exe'
  selection_wso2_path:
    ParentCommandLine|contains:
      - 'wso2'
      - 'carbon'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
  condition: selection_parent and selection_wso2_path and selection_child
falsepositives:
  - Rare WSO2 administrative scripts invoked by the server runtime; baseline and allowlist per host
level: high
---
title: Linux WSO2 Server Spawning Shell or Downloader
description: Detects the WSO2 Java runtime on Linux spawning shells, downloaders, or reconnaissance tools — a hallmark of web-layer compromise via authentication bypass.
id: 9e1d4c62-7b83-4f5a-a2d4-6c8e9f0a1b2c
status: experimental
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059.004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'wso2'
      - 'carbon'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
  condition: selection_parent and selection_child
falsepositives:
  - Startup scripts and health checks executed by the WSO2 wrapper; correlate with service start times
level: high
---
title: Unauthenticated Access Attempts to WSO2 Management Console
description: Detects HTTP requests to WSO2 administrative and management endpoints from non-management networks, consistent with scanning and exploitation of authentication bypass flaws such as CVE-2026-5430.
id: 5f2a8e47-1c96-4d3b-b7a2-9d4e5f6a7b8c
status: experimental
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: proxy
detection:
  selection_uri:
    cs-uri|contains:
      - '/carbon/admin'
      - '/services/'
      - '/management'
      - '/identity/'
  selection_status:
    sc-status:
      - 200
      - 302
  condition: selection_uri and selection_status
falsepositives:
  - Legitimate administrator access from management subnets; filter by known admin source IP ranges
level: medium

// Hunt for requests to WSO2 administrative endpoints and subsequent anomalous responses
// Scope: firewalls/proxies ingested as CommonSecurityLog, plus Defender process telemetry
let lookback = 14d;
let admin_paths = dynamic(["/carbon/admin", "/services/", "/management", "/identity/"]);
let SuspiciousWeb =
    CommonSecurityLog
    | where TimeGenerated > ago(lookback)
    | where RequestURL has_any (admin_paths)
    | where HttpStatusCode in (200, 302)
    | extend SourceIP = coalesce(SourceIP, DeviceAddress)
    | summarize Requests = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
                Paths = make_set(RequestURL), Statuses = make_set(HttpStatusCode)
      by SourceIP, DestinationHostName
    | where Requests > 5 or array_length(Paths) > 1;
SuspiciousWeb
| join kind=leftouter (
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where InitiatingProcessCommandLine has_any ("wso2", "carbon")
       or ProcessCommandLine has_any ("wso2", "carbon")
    | where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "sh", "bash", "curl", "wget", "nc", "python3")
    | project DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, ProcessTime = TimeGenerated, AccountName
  ) on $left.DestinationHostName == $right.DeviceName
| project SourceIP, DestinationHostName, Requests, FirstSeen, LastSeen, Paths,
          FileName, ProcessCommandLine, ProcessTime, AccountName
| order by LastSeen desc

-- Hunt for WSO2 compromise artifacts: child processes of the Java runtime,
-- recently modified web app files, and unexpected outbound connections
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)wso2|carbon'
   OR (Name =~ '(?i)cmd|powershell|pwsh|bash|sh$|curl|wget|nc|python'
       AND Ppid IN (
         SELECT Pid FROM pslist() WHERE CommandLine =~ '(?i)wso2|carbon'
       ))

-- Also review recently modified files in WSO2 web application directories (possible web shells)
LET webshell_hunt = SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['/opt/wso2*/**/repository/deployment/server/webapps/**/*.jsp',
                 '/opt/wso2*/**/repository/deployment/server/webapps/**/*.war',
                 'C:/Program Files/WSO2/**/webapps/**/*.jsp'])
WHERE Mtime > now() - 1209600
ORDER BY Mtime DESC

SELECT * FROM webshell_hunt

#!/bin/bash
# CVE-2026-5430 WSO2 verification and hardening script
# Run on each WSO2 host. Review output before making changes.

set -euo pipefail

WSO2_HOME="${WSO2_HOME:-/opt/wso2}"
echo "=== WSO2 version and patch-level verification ==="

# 1. Identify installed product and version
find "${WSO2_HOME}" -maxdepth 3 -name 'version.txt' -o -name 'product.txt' 2>/dev/null | while read -r f; do
  echo "[i] $f:"; cat "$f"
done

# 2. List applied updates via WSO2 Update Manager (U2) if present
if [ -x "${WSO2_HOME}/bin/update_linux" ]; then
  echo "[i] Querying WSO2 Update Manager for current update level..."
  "${WSO2_HOME}/bin/update_linux" --check || true
else
  echo "[!] Update Manager client not found under ${WSO2_HOME}/bin — check updates manually via the WSO2 Updates portal"
fi

# 3. Hunt for signs of exploitation: recent JSP/WAR changes and unexpected admin access
if [ -d "${WSO2_HOME}/repository/deployment/server/webapps" ]; then
  echo "=== Web apps modified in last 14 days (possible web shells) ==="
  find "${WSO2_HOME}/repository/deployment/server/webapps" -name '*.jsp' -mtime -14 -ls
fi

LOGDIR="${WSO2_HOME}/repository/logs"
if [ -d "${LOGDIR}" ]; then
  echo "=== Requests to admin/management endpoints in access logs ==="
  grep -hE '(/carbon/admin|/services/|/management|/identity/)' "${LOGDIR}"/*.log 2>/dev/null \
    | grep -E ' (200|302) ' | awk '{print $1}' | sort | uniq -c | sort -rn | head -20

  echo "=== Authentication anomalies (failed/suspicious logins) ==="
  grep -hiE '(authentication.*fail|invalid credentials|login.*denied)' "${LOGDIR}"/wso2carbon.log* 2>/dev/null | tail -50
fi

# 4. Verify the management console is not exposed externally
echo "=== Listening interfaces for WSO2 ports (9443/9763/8243/8280) ==="
ss -tlnp 2>/dev/null | grep -E ':(9443|9763|8243|8280)' || echo "[i] No default WSO2 ports listening"

# 5. Harden: restrict management console to admin subnets via firewall (adjust CIDR)
ADMIN_NET="10.0.10.0/24"
echo "=== Applying firewall restriction: 9443/9763 limited to ${ADMIN_NET} ==="
sudo iptables -C INPUT -p tcp -m multiport --dports 9443,9763 -s "${ADMIN_NET}" -j ACCEPT 2>/dev/null \
  || sudo iptables -I INPUT -p tcp -m multiport --dports 9443,9763 -s "${ADMIN_NET}" -j ACCEPT
sudo iptables -C INPUT -p tcp -m multiport --dports 9443,9763 -j DROP 2>/dev/null \
  || sudo iptables -I INPUT -p tcp -m multiport --dports 9443,9763 -j DROP

echo "[+] Done. Apply the vendor security patch for CVE-2026-5430 immediately if not already applied."