CISA Flags WSO2 Security Flaw Under Active Exploitation
CISA added actively exploited WSO2 flaw CVE-2026-5430, a CVSS 10 path traversal and JWT bug, to KEV.
CISA added CVE-2026-5430 to the Known Exploited Vulnerabilities catalog on September 24, 2026, after evidence of active exploitation, and set a federal remediation deadline of September 27. The flaw affects WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway. CISA describes a path traversal issue that can allow unrestricted file uploads and remote code execution. The CVE record also cites improper JWT signature verification, CWE-347, that can enable crafted tokens, administrative compromise, and full account takeover, with a CVSS v3.1 score of 10.0 in one scenario. Ransomware use is unknown, but BOD 26-04 requires forensic triage.
- CVE-2026-5430 entered CISA KEV with a September 27 federal deadline.
- Path traversal may allow unrestricted uploads and remote code execution.
- A JWT validation weakness can lead to administrative account takeover.
- One CVSS v3.1 scenario scores 10.0; ransomware use is unknown.
- BOD 26-04 requires forensic triage, not patching alone.
- CVEs
- CVE-2026-5430
- Vendors
- WSO2
- Organizations
- CISA
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-5430 | Unauthenticated JWT Algorithm Bypass in WSO2 API Manager and Gateways | 10.0 | 22% | KEVPoC ×2 | KEV |
From the original article
2 min read at gbhackers.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability affecting WSO2, tracked as CVE-2026-5430, to its Known Exploited Vulnerabilities (KEV) catalog.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.