September 2026 CVE Landscape
Recorded Future says 80 vulnerabilities were actively exploited in September 2026, including NetScaler zero-days.
85
CVE-2026-5430
Unauthenticated JWT Algorithm Bypass in WSO2 API Manager and Gateways
CISA: WSO2 Multiple Products Path Traversal Vulnerability
- CVSS 3.1
- 10.0 critical
- EPSS
- 22%p98
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
CVE-2026-5430 is a flaw in WSO2's JWT authentication mechanism (CWE-347, improper verification of cryptographic signature) in which tokens signed with algorithms other than those explicitly configured are incorrectly accepted and validated. A remote, unauthenticated attacker can craft a JWT with an unsupported algorithm and present it to gain unauthorized access, up to and including compromise of administrative accounts and full account takeover. The flaw carries a CVSS 3.1 base score of 10.0 (scope changed) and 9.8 in single-tenant deployments, and affects WSO2 API Manager, API Control Plane, Traffic Manager, and Universal Gateway; the CISA catalog entry titles it as a path traversal issue, but the technical description is a JWT signature-validation bypass. It was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-24, and press reports describe active exploitation targeting WSO2 API Manager with forged admin tokens, despite a low EPSS score (0.4%, 29th percentile).
What to do: Immediately apply the vendor's patched versions or mitigations per the WSO2 security advisory and CISA BOD 26-04 timelines (or discontinue use if mitigations are unavailable), since this is in the KEV catalog and being exploited with forged admin tokens. Restrict internet access to management consoles, API Control Plane, and gateway endpoints, and hard-enforce the JWT algorithms configured at each token validator. Hunt for JWTs with unexpected "alg" headers, unexplained admin logins, or new rogue applications/clients, and rotate admin credentials, signing keys, and issued tokens on any suspected compromise.
| Product | Affected |
|---|---|
| wso2 api manager | — |
| wso2 api control plane | — |
| wso2 traffic manager | — |
| wso2 universal gateway | — |
Estimated exposure
moderatelow thousands of internet-exposed WSO2 deployments (order of 10^3-10^4 systems) — Public internet scans (Shodan/Censys) have historically shown several thousand exposed WSO2 carbon management consoles and gateway endpoints during prior WSO2 incidents, and WSO2 is deployed by thousands of enterprises, most of which run…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.
KEVCISA Known Exploited Vulnerability
- Affected
- WSO2 Multiple Products
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Vendors
- wso2
- Products
- api control plane, api manager, traffic manager, universal gateway
- Weakness
- CWE-347
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
In the news
10 storiesCISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks
CISA says attackers are exploiting critical WSO2 and Adobe Commerce flaws plus SharePoint and MikroTik bugs.
84
CISA Flags WSO2 Security Flaw Under Active Exploitation
CISA added actively exploited WSO2 flaw CVE-2026-5430, a CVSS 10 path traversal and JWT bug, to KEV.
84
Enterprises Warned of Attacks Exploiting WSO2 Vulnerability
Attackers are actively exploiting CVE-2026-5430 (CVSS 10), a WSO2 JWT authentication bypass, to access enterprise API credentials and sensitive data.
84
CISA Warns of WSO2 Multiple Products Vulnerability Exploited in Attacks
CISA says attackers are exploiting WSO2 CVE-2026-5430, a path-traversal flaw that can lead to remote code execution.
82
U.S. CISA adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog
CISA added exploited WSO2 and Adobe Commerce flaws to the KEV catalog, with federal fixes due September 27.
82
WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV
CISA added WSO2 path traversal CVE-2026-5430 and Adobe Commerce authorization flaw CVE-2026-71362 to its KEV catalog amid active exploitation.
80
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added actively exploited WSO2 and Adobe Commerce flaws to the Known Exploited Vulnerabilities catalog.
78
Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens
watchTowr observed active exploitation of CVE-2026-5430, a WSO2 API Manager JWT bypass using forged admin tokens, risking credential theft and account takeover.
78
Critical WSO2 Vulnerability Allow Hackers to Gain Full Admin Access
WSO2 discloses CVE-2026-5430 (CVSS 10.0), an unauthenticated JWT authentication bypass allowing admin account takeover across its API management products.
65