Cybersecurity
CISA adds WSO2 and Adobe Commerce flaws to KEV
CISA added two critical flaws affecting WSO2 and Adobe Commerce to its exploited-vulnerabilities list after reports of active abuse, and federal agencies were told to patch them by 27 September 2026.
- CISA added CVE-2026-5430 and CVE-2026-71362 to its Known Exploited Vulnerabilities catalogue on Thursday.
- CISA said the additions were based on evidence of active exploitation.
- watchTowr said it had seen exploitation attempts against CVE-2026-5430 on honeypots since at least 13 September 2026.
- Sansec said in August 2026 that it had detected and blocked exploitation attempts against CVE-2026-71362.
- FCEB agencies were told to apply fixes for both vulnerabilities by 27 September 2026.
CISA added CVE-2026-5430 and CVE-2026-71362 to its Known Exploited Vulnerabilities catalogue on Thursday after saying there was evidence of active exploitation. CVE-2026-5430 was described as a path-traversal flaw in WSO2 API Control Plane, API Manager, Traffic Manager and Universal Gateway, while CVE-2026-71362 was described as an incorrect authorisation flaw in Adobe Commerce and Magento.
watchTowr said it had been seeing exploitation attempts against CVE-2026-5430 on honeypots since at least 13 September 2026. Yordan Ganchev, its principal threat intelligence specialist, said the firm captured forged JWT tokens on that date and reproduced the flaw itself.
For CVE-2026-71362, Sansec said in August 2026 that it had detected and blocked attack attempts. The company said the flaw could let an attacker switch one customer session to another account and reach private customer data.
Previdian said its telemetry showed a single IP address from Australia trying to exploit the flaw against its honeypot sensors on 10 September 2026. Adobe had not yet updated its advisory to confirm whether exploitation had been observed, and FCEB agencies were told to apply fixes by 27 September 2026.
Named in this story
People
- Yordan Ganchev
- was watchTowr's principal threat intelligence specialist who commented on the flaw
Companies
- WSO2
- had products affected by CVE-2026-5430
- Adobe
- had Adobe Commerce and Magento affected and had not yet updated its advisory
- watchTowr
- said it had seen exploitation against CVE-2026-5430 on honeypots
- Sansec
- said it had detected and blocked exploitation attempts against CVE-2026-71362
- Previdian
- said its telemetry saw an attempted exploit against its honeypot sensors
Governments and agencies
- U.S. Cybersecurity and Infrastructure Security Agency (CISA)
- added the two flaws to its Known Exploited Vulnerabilities catalogue
- Federal Civilian Executive Branch (FCEB) agencies
- were told to apply fixes by 27 September 2026
Products and systems
- Adobe Commerce
- was one of the affected platforms in CVE-2026-71362
- Magento
- was one of the affected platforms in CVE-2026-71362
- WSO2 API Control Plane
- was named as affected by the path traversal flaw
- WSO2 API Manager
- was named as affected by the path traversal flaw
- WSO2 Traffic Manager
- was named as affected by the path traversal flaw
- WSO2 Universal Gateway
- was named as affected by the path traversal flaw
- CVE-2026-5430
- was a path traversal flaw linked to unrestricted file upload and possible code execution
- CVE-2026-71362
- was an authorisation flaw that could raise access to sensitive resources
How the source tells it
The piece was mostly a plain security update, but it carried an urgent register through active-exploitation reports and a fixed patch deadline.
- urgency built around active-exploitation claims and a September 27 remediation deadline