The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities affecting WSO2 and Adobe Commerce to its Known Exploited Vulnerabilities (KEV) catalog, citing clear evidence of active exploitation. These flaws, tracked as CVE-2026-5430 and CVE-2026-71362, carry CVSS scores of 9.8 and 9.1 respectively, and pose severe risks to enterprises relying on these platforms for API management and e-commerce operations.  CVE-2026-5430 is a path traversal vulnerability impacting WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway. It enables unauthenticated attackers to upload arbitrary files and achieve remote code execution without user interaction. Security firm watchTowr reported observing in-the-wild exploitation since at least September 13, 2026, including forged JWT tokens targeting the flaw. Yordan Ganchev, a principal threat intelligence specialist at watchTowr, emphasized that WSO2 serves nearly 1,000 customers across banking, government, telecom, and logistics—sectors that cannot afford delayed patching.  The second flaw, CVE-2026-71362, affects Adobe Commerce and Magento through an incorrect authorization bug that allows attackers to hijack customer sessions and switch accounts without interaction. This grants unauthorized access to private customer data and sensitive resources. Dutch e-commerce security company Sansec detected and blocked exploitation attempts in August 2026, while Previdian telemetry recorded a lone Australian IP targeting honeypots on September 10, 2026. Although Adobe has not yet confirmed active exploitation in its advisory, the evidence strongly suggests coordinated abuse of this vulnerability.  CISA’s inclusion of both flaws in the KEV catalog triggers mandatory remediation timelines for Federal Civilian Executive Branch (FCEB) agencies, which must apply patches by September 27, 2026. This deadline underscores the urgency for all organizations using WSO2 or Adobe Commerce to prioritize updates immediately. With threat actors already weaponizing these vulnerabilities, waiting for formal advisories or public proof-of-concept code could leave networks exposed to data theft, account takeover, and full system compromise.  Organizations should audit their deployments of WSO2 and Adobe Commerce without delay, ensuring all systems are patched to the latest secure versions. For WSO2, this means updating API Manager and related components to close the path traversal vector. Adobe Commerce and Magento users must apply authorization fixes to prevent session hijacking. Given the high CVSS scores, broad industry usage, and confirmed exploitation, treating these vulnerabilities as critical priorities is essential to safeguarding digital infrastructure and customer data from escalating cyber threats.

same weakness existed previously read more about CISA Adds CrushFTP Vulnerability to KEV Catalog Following Confirmed Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The list of vulnerabilities is as follows - CVE-2025-68645 (CVSS score: 8.8) - A PHP remote file inclusion vulnerability in Synacor Zimbra Collaboration Suite (ZCS) that could allow a

CISA has directed federal agencies to prioritize patching based on four urgency criteria, including public exposure, exploit automation, system takeover potential, and active real-world exploitation. The new BOD 26-04 aims to speed remediation for the most critical vulnerabilities, with some fixes required in as little as three days and broader policy updates due over the next 180 days. #CISA #BOD26-04 #KEVCatalog

CISA has added two new vulnerabilities to its KEVCatalog, based on evidence of active exploitation.

CISA has added one new vulnerability to its KEVCatalog, based on evidence of active exploitation.

CISA has added two new vulnerabilities to its KEVCatalog, based on evidence of active exploitation.

CISA has added one new vulnerability to its KEVCatalog, based on evidence of active exploitation.