CISA Warns of Active Exploitation in WSO2 and Adobe Commerce Products
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about ongoing attacks exploiting multiple vulnerabilities in widely used enterprise software, including critical flaws in WSO2 and Adobe Commerce platforms. The agency has added two critical-severity flaws to its Known Exploited Vulnerabilities (KEV) catalog, mandating urgent action from federal agencies and encouraging all organizations to prioritize patching.
Critical Authentication Bypass in WSO2 Products (CVE-2026-5430)
One of the newly added vulnerabilities is CVE-2026-5430, a critical authentication bypass flaw affecting WSO2 API Manager versions 4.1.0 through 4.6.0, as well as API Control Plane, Traffic Manager, and Universal Gateway versions 4.5.0 and 4.6.0. The flaw received a maximum severity score due to its potential to allow attackers to compromise administrative accounts and gain full control of affected systems. The vulnerability stems from the JWT authentication mechanism accepting tokens signed with an unsupported algorithm, enabling attackers to forge valid tokens.
Although CISA did not disclose specific attack details, security firm watchTowr reported observing exploitation attempts via its honeypots. On September 13, researchers detected a limited number of attempts from a single IP address targeting a WSO2 product with forged JWT tokens. Initially, the wrong product was targeted, but watchTowr later reproduced the attack on the correct vulnerable component, confirming that a forged token could expose API endpoints and application credentials.
"WSO2 is not a niche target," said Yordan Ganchev, threat intelligence specialist at watchTowr. "Its technology is used by nearly 1,000 customers across banking, government, telecommunications, and logistics. Organizations in these sectors can't afford to wait for exploitation to be formally confirmed."
Critical Authorization Flaw in Adobe Commerce (CVE-2026-71362)
The second critical vulnerability added to the KEV catalog is CVE-2026-71362, an incorrect authorization flaw in Adobe Commerce and Magento e-commerce platforms. According to e-commerce security firm Sansec, this vulnerability is being actively exploited in the wild and requires no existing account, administrator privileges, or user interaction for attackers to leverage it.
Both CVE-2026-5430 and CVE-2026-71362 carry a deadline of Sunday, September 27, for federal agencies to apply recommended updates, implement mitigations, or discontinue use of the affected products. CISA urges all organizations, not just federal entities, to treat these vulnerabilities as high priority due to their critical severity and active exploitation.
Additional Vulnerabilities in SharePoint and RouterOS Also Under CISA Monitoring
CISA also highlighted two other vulnerabilities being exploited in attacks, though with slightly longer remediation timelines for federal agencies.
The first is CVE-2026-65660, a high-severity code injection flaw in Microsoft SharePoint. The second is CVE-2026-67279, a medium-severity pre-authentication SSH state-machine/workflow bypass in Mikrotik RouterOS. For these two flaws, CISA has set a deadline of Monday, September 28, for federal agencies to apply fixes or mitigations.
While these flaws are less severe than the WSO2 and Adobe Commerce issues, their inclusion in the KEV catalog underscores the broad scope of active threats targeting enterprise infrastructure. CISA continues to monitor exploitation trends and urges organizations to consult the KEV catalog regularly to prioritize remediation efforts based on real-world attack activity.
Source: BleepingComputer