Trend Micro Research observed and disclosed the active exploitation of a vulnerability affecting WSO2 products that was patched in April 2022. WSO2 is a popular middleware vendor that sells open source, cloud-ready application program interface (API) management software, allowing users to efficiently design, and maintain APIs. The vulnerability, tracked as CVE-2022-29464, is an improper input validation flaw that allows for unrestricted file upload, and its successful exploitation would allow an attacker to upload a maliciously crafted payload via an arbitrary remote code execution (RCE). According to Trend Micro, the exploitation of this flaw is rather simple, and vulnerable WSO2 devices can be easily found via Google or Shodan searches. WSO2 products are considered some of the most valuable infiltration assets for threat actors because they are open-source Identity Access Management (IAM) products and are leveraged in virtually every sector including healthcare, finance, and energy due to their industry popularity. If threat actors successfully exploit the targeted IAM servers, they could access all of the data and services provided by the servers. Although this vulnerability was successfully patched in April, there are still many WSO2 products In-the-Wild that haven’t implemented the patch for this flaw. CTIX analysts urge all administrators leveraging and maintaining these WSO2 products to update to the most recent secure version. Since this flaw continues to be a valuable vector regardless of the patch, threat actors have been modifying and working tirelessly to circumvent the latest security measures. Administrators should exercise persistent due diligence with regard to their networks to defend against these types of attacks, to include an ongoing process of manually checking defense around WSO2 products, to delete anything that doesn’t belong like unknown files, old user accounts, or deprecated processes.