WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV
CISA added WSO2 path traversal CVE-2026-5430 and Adobe Commerce authorization flaw CVE-2026-71362 to its KEV catalog amid active exploitation.
CISA added CVE-2026-5430 (CVSS 9.8), a path traversal in WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway enabling unrestricted file upload and RCE, and CVE-2026-71362 (CVSS 9.1), an incorrect authorization flaw in Adobe Commerce and Magento allowing account takeover without user interaction. watchTowr observed in-the-wild exploitation of the WSO2 flaw on honeypots since September 13, 2026, and Sansec blocked exploitation attempts against the Adobe flaw in August 2026. FCEB agencies must remediate both vulnerabilities by September 27, 2026.
- CVE-2026-5430 (CVSS 9.8): WSO2 path traversal to unrestricted file upload and RCE
- CVE-2026-71362 (CVSS 9.1): Adobe Commerce session switching grants access to victim accounts
- watchTowr saw WSO2 exploitation since September 13; Sansec blocked Adobe attempts
- FCEB agencies must patch both vulnerabilities by September 27, 2026
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-5430 | Unauthenticated JWT Algorithm Bypass in WSO2 API Manager and Gateways | 10.0 | 22% | KEVPoC ×2 | KEV |
| CVE-2026-71362 | Unauthenticated Privilege Escalation Flaw in Adobe Commerce (Magento) | 9.1 | 92% | KEVPoC | KEV |
From the original article
1 min read at thehackernews.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.