U.S. CISA adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog
CISA added exploited WSO2 and Adobe Commerce flaws to the KEV catalog, with federal fixes due September 27.
CISA added CVE-2026-5430 and CVE-2026-71362 to its Known Exploited Vulnerabilities catalog and ordered federal agencies to remediate them by September 27, 2026. CVE-2026-5430, scored CVSS 10.0, affects multiple WSO2 products; the report describes failed JWT signature verification that can let attackers bypass authentication and take over accounts. CVE-2026-71362, scored CVSS 9.1, is an incorrect-authorization flaw in Adobe Commerce, Commerce B2B, and Magento Open Source through the July 2026 patches, allowing unauthenticated session switching and access to private customer data. Sansec said attackers began targeting the Adobe flaw in August 2026, shortly after disclosure.
- CVE-2026-5430 is a CVSS 10.0 WSO2 flaw described as a JWT authentication bypass.
- CVE-2026-71362, CVSS 9.1, lets attackers hijack Adobe Commerce customer sessions.
- Sansec observed exploitation attempts against the Adobe bug in August 2026.
- Federal agencies must fix both KEV entries by September 27, 2026.
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-5430 | Unauthenticated JWT Algorithm Bypass in WSO2 API Manager and Gateways | 10.0 | 22% | KEVPoC ×2 | KEV |
| CVE-2026-71362 | Unauthenticated Privilege Escalation Flaw in Adobe Commerce (Magento) | 9.1 | 92% | KEVPoC | KEV |
From the original article
2 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.