ARTIFICE DAILY AI + CYBER SECURITY BRIEFING

Cybersecurity

CISA warns of exploited WSO2, Adobe and SharePoint flaws

CISA said attackers were exploiting flaws in WSO2, Adobe Commerce, Microsoft SharePoint and Mikrotik RouterOS, and it set September deadlines for federal agencies to patch the critical issues.

BleepingComputer

CISA said several vulnerabilities were being used in attacks and added CVE-2026-71362, affecting Adobe Commerce, to its Known Exploited Vulnerabilities list. It also said CVE-2026-65660 in Microsoft SharePoint and CVE-2026-67279 in Mikrotik RouterOS were being exploited.

The WSO2 flaw, CVE-2026-5430, affected API Manager versions 4.1.0 to 4.6.0, and also API Control Plane, Traffic Manager and Universal Gateway in versions 4.5.0 and 4.6.0. In WSO2's May 3 advisory, the vendor said successful exploitation could let an attacker reach administrative accounts and take control.

CISA did not publish attack details, but watchTowr said its honeypots recorded a small number of attempts on 13 September from one IP address using forged JWT tokens against a WSO2 product. The firm said the first attempts targeted the wrong product for CVE-2026-5430, but it later reproduced the attack against the correct one and said forged tokens could reveal API endpoints and application credentials.

Sansec said CVE-2026-71362 was already being used by attackers. It said the issue required no existing account, administrator privileges or user interaction.

For the two critical issues it added to KEV, CISA gave federal agencies until 27 September to apply fixes or mitigations, or stop using the products. It set 28 September as the deadline for the SharePoint and Mikrotik issues and urged other organisations to prioritise the KEV entries.

Named in this story

People

Yordan Ganchev
was watchTowr's threat intelligence specialist quoted on the issue

Companies

WSO2
was the vendor of the affected API products
Adobe
was the maker of the Commerce and Magento platforms named in the article
Microsoft
was the maker of SharePoint
Mikrotik
was the maker of RouterOS
watchTowr
said its honeypots saw exploitation attempts and reproduced the attack
Sansec
said Adobe Commerce exploitation was already happening

Governments and agencies

Cybersecurity and Infrastructure Security Agency (CISA)
warned that several flaws were being exploited and added one to the KEV catalog

Products and systems

WSO2 API Manager
was one of the WSO2 products affected by CVE-2026-5430
API Control Plane
was one of the WSO2 products affected by CVE-2026-5430
Traffic Manager
was one of the WSO2 products affected by CVE-2026-5430
Universal Gateway
was one of the WSO2 products affected by CVE-2026-5430
Adobe Commerce
was added to the KEV catalog for an incorrect-authorization flaw
Magento
was named alongside Adobe Commerce as part of the affected e-commerce platforms
Microsoft SharePoint
was named as an actively exploited product with a code-injection flaw
RouterOS
was named as having a pre-authentication bypass flaw
Known Exploited Vulnerabilities (KEV) catalog
was the CISA list that received the new entries

How the source tells it

The register was largely matter-of-fact, but it used urgency and alarm through remediation deadlines and active-exploitation warnings.

  • urgency fixed deadlines for federal agencies and repeated calls to patch or stop using the products
  • alarm active-exploitation language and cited claims that attackers were already using the flaws