CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added actively exploited WSO2 and Adobe Commerce flaws to the Known Exploited Vulnerabilities catalog.
CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. CVE-2026-5430 is a path traversal flaw in multiple WSO2 products, and CVE-2026-71362 is an incorrect authorization flaw in Adobe Commerce and Magento. Binding Operational Directive 26-04 requires federal civilian agencies to prioritize remediation of high-risk KEV entries on exposed assets that can be fully compromised. CISA encourages all organizations to patch these vulnerabilities quickly.
- CVE-2026-5430 is a WSO2 path traversal added after active exploitation.
- CVE-2026-71362 is incorrect authorization in Adobe Commerce and Magento.
- BOD 26-04 requires FCEB agencies to prioritize exposed KEV flaws.
- CISA urges all organizations to remediate cataloged KEV vulnerabilities quickly.
- Products
- Adobe CommerceMagento
- Organizations
- CISA
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-5430 | Unauthenticated JWT Algorithm Bypass in WSO2 API Manager and Gateways | 10.0 | 22% | KEVPoC ×2 | KEV |
| CVE-2026-71362 | Unauthenticated Privilege Escalation Flaw in Adobe Commerce (Magento) | 9.1 | 92% | KEVPoC | KEV |
From the original article
1 min read at cisa.govCISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.