The vulnerability identified as CVE-2026-4249 affects the throttling event handling mechanism in WSO2 Universal Gateway versions 4.5.0, 4.6.0, and 4.7.0. It arises from insufficient validation of user-supplied JSON payloads, enabling unauthenticated remote attackers to inject malicious JSON data. This can lead to a persistent denial of service condition that disrupts the API Gateway, preventing legitimate API traffic from being processed and impacting overall service availability. The denial of service is persistent, requiring manual intervention to recover normal operations. The CVSS v3.1 score is 8.6, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability.

Successful exploitation results in a persistent denial of service on the API Gateway, blocking legitimate API traffic and causing complete service disruption. The denial of service condition is persistent and requires manual intervention to restore normal functionality, impacting service availability but not confidentiality or integrity.

No official patch or remediation level has been published by the vendor as of the current information. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until a fix is available, organizations should consider restricting access to the affected components and monitor for unusual JSON payloads if feasible. Because the vulnerability allows unauthenticated remote exploitation, prompt attention to vendor updates is critical.