Two Critical Flaws Confirmed Under Active Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday, September 24, 2026, added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-5430, affecting multiple WSO2 API management products, and CVE-2026-71362, affecting Adobe Commerce and Magento Open Source. Both entries were added based on confirmed evidence of active exploitation, and CISA has ordered Federal Civilian Executive Branch (FCEB) agencies to remediate both flaws by September 27, 2026, under Binding Operational Directive (BOD) 26-04.
Neither flaw is new — patches for both have been available for months — but researchers say attackers moved against them well before the KEV listing made the exploitation public. Security firm watchTowr reported seeing forged-token attack attempts against its honeypot network targeting the WSO2 flaw since at least September 13, 2026, while Magento security specialist Sansec said it detected and blocked exploitation attempts against the Adobe Commerce flaw as far back as August 2026, with the Australian Cyber Security Centre (ACSC) separately flagging active exploitation roughly two weeks before the KEV addition.
Incident Details
| Attribute | Value |
|---|---|
| Date Added to KEV | September 24, 2026 |
| WSO2 Vulnerability | CVE-2026-5430 — CVSS 9.8 (10.0 in multi-tenant deployments) |
| Adobe Commerce/Magento Vulnerability | CVE-2026-71362 — CVSS 9.1 |
| Federal Remediation Deadline | September 27, 2026 (BOD 26-04) |
| WSO2 Affected Products | API Control Plane, API Manager, Traffic Manager, Universal Gateway |
| Adobe Affected Products | Adobe Commerce, Adobe Commerce B2B, Magento Open Source |
| WSO2 Advisory | WSO2-2026-5328, published May 3, 2026 |
| Adobe Advisory | APSB26-92, published August 11, 2026 |
| Exploitation First Observed | September 13, 2026 (WSO2, per watchTowr); August 2026 (Adobe, per Sansec) |
How the Flaws Work
CVE-2026-5430 — WSO2 JWT Authentication Bypass
WSO2's own advisory (WSO2-2026-5328) describes CVE-2026-5430 as an improper verification of cryptographic signature issue (CWE-347) in how the API Control Plane, API Manager, Traffic Manager, and Universal Gateway validate the algorithm field inside incoming JSON Web Tokens. An attacker who submits a token signed with an unsupported algorithm can bypass authentication entirely — no credentials or user interaction required — potentially leading to full administrative account takeover. CISA's KEV entry lists the flaw under the name "WSO2 Multiple Products Path Traversal Vulnerability" and describes the impact as unrestricted file upload leading to remote code execution, indicating attackers have chained the authentication bypass into deeper compromise once inside. Affected versions span API Control Plane 4.5.0–4.6.0, API Manager 4.1.0–4.6.0, Traffic Manager 4.5.0–4.6.0, and Universal Gateway 4.5.0–4.6.0. The flaw was reported by security firm hacktron.ai, and fixes have been available via WSO2's update channels since the advisory's May publication — meaning organizations had roughly four months to patch before watchTowr observed active exploitation.
CVE-2026-71362 — Adobe Commerce/Magento Session Identity Flaw
CVE-2026-71362 is an incorrect authorization vulnerability (CWE-863) patched in Adobe's APSB26-92 bulletin alongside six other issues, five of them rated Critical. The flaw stems from Adobe Commerce and Magento Open Source failing to correctly bind a customer's identity to their account session, allowing an unauthenticated attacker with only network access to a storefront to switch a customer session over to a different customer's account — exposing that victim's order history, saved payment methods, and personal data without any credentials or user interaction. Affected releases include Adobe Commerce, Adobe Commerce B2B, and Magento Open Source builds up to their respective "-2026-jul" maintenance tracks; Adobe shipped fixes in the corresponding "-2026-aug" builds and also released an isolated patch for merchants who cannot immediately move to the full security train.
Impact Assessment
| Impact Area | Description |
|---|---|
| Authentication/Authorization Bypass | Both flaws allow attackers to skip normal authentication or authorization checks entirely, with no credentials needed |
| Account Takeover | WSO2 flaw can escalate to full administrative access; Adobe Commerce flaw exposes individual customer accounts and their data |
| Scale of Exposure | WSO2 technology is used by an estimated 1,000-plus organizations across banking, government, telecommunications, and logistics, including customers such as ING, Qantas, Hilton, and the U.S. Department of Justice; Adobe Commerce and Magento power tens of thousands of e-commerce storefronts globally |
| Remote Code Execution Risk | CISA's KEV description for the WSO2 flaw ties it to unrestricted file upload and remote code execution once authentication is bypassed |
| Federal Exposure | FCEB agencies face a compressed three-day remediation window (by September 27, 2026) under BOD 26-04, which also mandates forensic triage for affected systems |
| Patch Lag | Both vulnerabilities had fixes available for months (WSO2 since May 2026, Adobe since August 2026) before confirmed exploitation, underscoring the gap between patch availability and deployment |
Recommendations
For System Administrators
- Identify all deployments of WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway at versions 4.1.0 through 4.6.0 and apply the update levels specified in advisory WSO2-2026-5328, or migrate to an unaffected version immediately.
- Identify all Adobe Commerce, Adobe Commerce B2B, and Magento Open Source installations on the "-2026-jul" track or earlier and update to the "-2026-aug" security train, or apply Adobe's isolated patch for APSB26-92 if a full upgrade cannot happen immediately.
- Where immediate patching isn't feasible, restrict network access to WSO2 management and gateway interfaces, and place Magento/Adobe Commerce storefronts behind a WAF configured to detect session-manipulation and forged-token patterns.
For Security Teams
- Hunt for indicators of JWT algorithm-confusion attacks against WSO2 gateways — look for tokens signed with unexpected or unsupported algorithms in access logs dating back to at least September 13, 2026.
- Review Magento/Adobe Commerce customer account logs for anomalous session-to-account binding changes or account access from unfamiliar sessions, particularly activity traceable to August 2026 onward.
- Treat both CVEs as confirmed breach indicators, not theoretical risks — Sansec, watchTowr, and the ACSC have all independently confirmed exploitation predating the KEV listing.
For Federal Agencies and Enterprise Operators
- FCEB agencies must complete remediation, including any BOD 26-04-mandated forensic triage, by September 27, 2026.
- Non-federal organizations, especially those in banking, telecommunications, logistics, and e-commerce, should treat the same deadline as a practical benchmark given the scale of exploitation already documented.
Key Takeaways
- CISA added CVE-2026-5430 (WSO2, CVSS 9.8) and CVE-2026-71362 (Adobe Commerce/Magento, CVSS 9.1) to its KEV catalog on September 24, 2026, based on confirmed active exploitation.
- Both flaws allow attackers to bypass authentication or authorization entirely, with the WSO2 flaw enabling potential admin takeover and remote code execution, and the Adobe Commerce flaw enabling customer account takeover.
- Exploitation predated the KEV listing by weeks: watchTowr saw WSO2 attacks starting September 13, 2026, while Sansec traced Adobe Commerce exploitation back to August 2026.
- Patches have existed for months — WSO2 since its May 3, 2026 advisory and Adobe since its August 11, 2026 bulletin — making unpatched exposure a self-inflicted risk at this point.
- Federal agencies must remediate by September 27, 2026 under BOD 26-04; given the confirmed exploitation, non-federal WSO2 and Adobe Commerce/Magento operators should treat the same deadline as urgent.
- WSO2's customer base spans roughly 1,000 organizations in banking, government, telecom, and logistics, while Adobe Commerce and Magento underpin tens of thousands of storefronts — both platforms represent high-value, high-blast-radius targets.