CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks

CVE-2026-5430 is a flaw in WSO2's JWT authentication mechanism (CWE-347, improper verification of cryptographic signature) in which tokens signed with algorithms other than those explicitly configured are incorrectly accepted and validated. A remote, unauthenticated attacker can craft a JWT with an unsupported algorithm and present it to gain unauthorized access, up to and including compromise of administrative accounts and full account takeover. The flaw carries a CVSS 3.1 base score of 10.0 (scope changed) and 9.8 in single-tenant deployments, and affects WSO2 API Manager, API Control Plane, Traffic Manager, and Universal Gateway; the CISA catalog entry titles it as a path traversal issue, but the technical description is a JWT signature-validation bypass. It was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-24, and press reports describe active exploitation targeting WSO2 API Manager with forged admin tokens, despite a low EPSS score (0.4%, 29th percentile).

Do: Immediately apply the vendor's patched versions or mitigations per the WSO2 security advisory and CISA BOD 26-04 timelines (or discontinue use if mitigations are unavailable), since this is in the KEV catalog and being exploited with forged admin tokens. Restrict internet access to management consoles, API Control Plane, and gateway endpoints, and hard-enforce the JWT algorithms configured at each token validator. Hunt for JWTs with unexpected "alg" headers, unexplained admin logins, or new rogue applications/clients, and rotate admin credentials, signing keys, and issued tokens on any suspected compromise.

CVE-2026-65660 is an improper control of code generation (CWE-94) flaw in Microsoft Office SharePoint Server that allows an authenticated, low-privilege attacker to inject and execute arbitrary code over a network. The bug is triggered after login by sending crafted input that SharePoint processes and executes, so any account with basic access to the SharePoint site — including a standard user — is a viable attack path. Successful exploitation yields remote code execution on the SharePoint server with the privileges of the SharePoint service account, threatening full compromise of confidentiality, integrity, and availability (CVSS 8.8). Notably, Microsoft initially classified the flaw as spoofing before it was recharacterized as authenticated RCE, and Canada's Cyber Centre has issued advisory AL26-023 about it. A public proof-of-concept exists on GitHub, but the issue is not in CISA's KEV catalog and there are no confirmed reports of in-the-wild exploitation yet, though EPSS (1.2%, 67th percentile) suggests above-average likelihood of attempted exploitation.

Do: Apply Microsoft's security update for SharePoint Server from the corresponding Patch Tuesday release as soon as possible, prioritizing any server reachable from the internet or exposed to broad internal user populations. Because exploitation only requires an authenticated low-privilege account, review recent SharePoint audit logs for anomalous behavior by ordinary users (unexpected page/app modifications, unusual requests preceding process activity), and enforce least-privilege access so standard accounts cannot reach sensitive site collections. Verify patch levels across all SharePoint farms, including pre-production and forgotten servers, and monitor Microsoft's advisory and the Canadian Cyber Centre's AL26-023 for updates on active exploitation.

CVE-2026-67279 is an authentication-ordering flaw (CWE-841) in the SSH server of MikroTik RouterOS: after a client-requested SSH rekey, the server enters the connection protocol even though user authentication was never attempted. An unauthenticated SSH client can therefore open a session channel and send an exec request, and on affected builds the server dispatches the command without any credentials. This lets the attacker create, overwrite, and reconstruct files in the RouterOS managed file namespace, including support files that contain configuration and diagnostic data. Any MikroTik device running RouterOS builds older than the fixed releases is affected, although remote exploitation requires the SSH service to be reachable by the attacker. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and EPSS estimates a 0.4% probability of exploitation in the next 30 days, so no exploitation is currently known.

Do: Upgrade RouterOS to 6.49.21 (Long-term v6), 7.23.4 (Long-term v7), or 7.24.2 (Stable). Until patched, restrict SSH access to trusted management networks/VPN or disable the SSH service where it is not needed. Review the RouterOS file list and SSH logs for unexpected or reconstructed files and session activity, since attackers have recently chained multiple MikroTik flaws against routers.

CVE-2026-71362 is an incorrect-authorization flaw (CWE-863) in Adobe Commerce, the e-commerce platform formerly known as Magento, in which authorization checks are applied incorrectly and can be bypassed. It is triggered over the network without authentication or user interaction, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). A successful attacker gains elevated access to sensitive resources — a privilege-escalation condition that Adobe's APSB26-92 advisory and press coverage describe as an account-takeover risk. Any organization running an unpatched Adobe Commerce/Magento deployment is affected; exact version ranges are listed in Adobe security bulletin APSB26-92. The flaw came under active attack shortly after public disclosure, and its EPSS score of 25.1% (98th percentile) signals a high likelihood of continued near-term exploitation.

Do: Apply the fix released under Adobe advisory APSB26-92 immediately, prioritizing internet-facing Commerce/Magento instances, and check the bulletin for the exact patched version ranges for your deployment. Because exploitation requires no credentials or user interaction, review admin accounts, API integrations, and user/role assignments for unauthorized privilege changes, and restrict admin-panel and storefront API access where feasible. Monitor Adobe's advisory for indicators of compromise given confirmed in-the-wild exploitation.