A vulnerability in the mutual TLS (mTLS) implementation of System REST APIs and SOAP services in multiple WSO2 products allows unauthenticated requests due to improper client certificate validation in certain default configurations. This can enable attackers with network access to gain administrative privileges and perform unauthorized actions. The issue affects only specific mTLS flows when enabled and accessible, and does not impact other certificate-based authentication methods or APIs served through the WSO2 API Gateway.