WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV

CVE-2026-5430 is a flaw in WSO2's JWT authentication mechanism (CWE-347, improper verification of cryptographic signature) in which tokens signed with algorithms other than those explicitly configured are incorrectly accepted and validated. A remote, unauthenticated attacker can craft a JWT with an unsupported algorithm and present it to gain unauthorized access, up to and including compromise of administrative accounts and full account takeover. The flaw carries a CVSS 3.1 base score of 10.0 (scope changed) and 9.8 in single-tenant deployments, and affects WSO2 API Manager, API Control Plane, Traffic Manager, and Universal Gateway; the CISA catalog entry titles it as a path traversal issue, but the technical description is a JWT signature-validation bypass. It was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-24, and press reports describe active exploitation targeting WSO2 API Manager with forged admin tokens, despite a low EPSS score (0.4%, 29th percentile).

Do: Immediately apply the vendor's patched versions or mitigations per the WSO2 security advisory and CISA BOD 26-04 timelines (or discontinue use if mitigations are unavailable), since this is in the KEV catalog and being exploited with forged admin tokens. Restrict internet access to management consoles, API Control Plane, and gateway endpoints, and hard-enforce the JWT algorithms configured at each token validator. Hunt for JWTs with unexpected "alg" headers, unexplained admin logins, or new rogue applications/clients, and rotate admin credentials, signing keys, and issued tokens on any suspected compromise.

CVE-2026-71362 is an incorrect-authorization flaw (CWE-863) in Adobe Commerce, the e-commerce platform formerly known as Magento, in which authorization checks are applied incorrectly and can be bypassed. It is triggered over the network without authentication or user interaction, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). A successful attacker gains elevated access to sensitive resources — a privilege-escalation condition that Adobe's APSB26-92 advisory and press coverage describe as an account-takeover risk. Any organization running an unpatched Adobe Commerce/Magento deployment is affected; exact version ranges are listed in Adobe security bulletin APSB26-92. The flaw came under active attack shortly after public disclosure, and its EPSS score of 25.1% (98th percentile) signals a high likelihood of continued near-term exploitation.

Do: Apply the fix released under Adobe advisory APSB26-92 immediately, prioritizing internet-facing Commerce/Magento instances, and check the bulletin for the exact patched version ranges for your deployment. Because exploitation requires no credentials or user interaction, review admin accounts, API integrations, and user/role assignments for unauthorized privilege changes, and restrict admin-panel and storefront API access where feasible. Monitor Adobe's advisory for indicators of compromise given confirmed in-the-wild exploitation.