CISA Warns of WSO2 Multiple Products Vulnerability Exploited in Attacks
CISA says attackers are exploiting WSO2 CVE-2026-5430, a path-traversal flaw that can lead to remote code execution.
CISA added WSO2 vulnerability CVE-2026-5430 to the Known Exploited Vulnerabilities catalog on September 24, 2026, citing active exploitation. The path-traversal flaw affects API Control Plane, API Manager, Traffic Manager, and Universal Gateway and can allow unintended file uploads and remote code execution. CISA catalogs it as CWE-347, improper verification of cryptographic signatures. Under BOD 26-04, federal civilian agencies must apply vendor mitigations by September 27, 2026, and conduct forensic triage; ransomware use has not been confirmed.
- CISA added CVE-2026-5430 to the KEV catalog on September 24, 2026.
- Path traversal may allow unrestricted file upload and remote code execution.
- API Manager, Control Plane, Traffic Manager, and Universal Gateway are affected.
- Federal agencies must mitigate by September 27 and perform forensic triage.
- CISA has not confirmed ransomware use of the flaw.
- CVEs
- CVE-2026-5430
- Vendors
- WSO2
- Organizations
- CISA
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-5430 | Unauthenticated JWT Algorithm Bypass in WSO2 API Manager and Gateways | 10.0 | 22% | KEVPoC ×2 | KEV |
From the original article
2 min read at cybersecuritynews.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical WSO2 vulnerability (CVE-2026-5430) to its Known Exploited Vulnerabilities catalog, warning that attackers are actively exploiting the flaw in real-world attacks.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.