An Attacker Leaves His Own Door Open An attacker hacked thousands of shops. Then he left the door to his own infrastructure open. A check of an exposed server run by the Lockster operator showed the scale of the damage. Through a critical zero-day in Magento Open Source and Adobe Commerce, attackers compromised at least 3,834 sites. Most were online stores.

The Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2.

 The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities affecting WSO2 and Adobe Commerce to its Known Exploited Vulnerabilities (KEV) catalog, citing clear evidence of active exploitation. These flaws, tracked as CVE-2026-5430 and CVE-2026-71362, carry CVSS scores of 9.8 and 9.1 respectively, and pose severe risks to enterprises relying on these platforms for API management and e-commerce operations.  CVE-2026-5430 is a path traversal vulnerability impacting WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway. It enables unauthenticated attackers to upload arbitrary files and achieve remote code execution without user interaction. Security firm watchTowr reported observing in-the-wild exploitation since at least September 13, 2026, including forged JWT tokens targeting the flaw. Yordan Ganchev, a principal threat intelligence specialist at watchTowr, emphasized that WSO2 serves nearly 1,000 customers across banking, government, telecom, and logistics—sectors that cannot afford delayed patching.  The second flaw, CVE-2026-71362, affects Adobe Commerce and Magento through an incorrect authorization bug that allows attackers to hijack customer sessions and switch accounts without interaction. This grants unauthorized access to private customer data and sensitive resources. Dutch e-commerce security company Sansec detected and blocked exploitation attempts in August 2026, while Previdian telemetry recorded a lone Australian IP targeting honeypots on September 10, 2026. Although Adobe has not yet confirmed active exploitation in its advisory, the evidence strongly suggests coordinated abuse of this vulnerability.  CISA’s inclusion of both flaws in the KEV catalog triggers mandatory remediation timelines for Federal Civilian Executive Branch (FCEB) agencies, which must apply patches by September 27, 2026. This deadline underscores the urgency for all organizations using WSO2 or Adobe Commerce to prioritize updates immediately. With threat actors already weaponizing these vulnerabilities, waiting for formal advisories or public proof-of-concept code could leave networks exposed to data theft, account takeover, and full system compromise.  Organizations should audit their deployments of WSO2 and Adobe Commerce without delay, ensuring all systems are patched to the latest secure versions. For WSO2, this means updating API Manager and related components to close the path traversal vector. Adobe Commerce and Magento users must apply authorization fixes to prevent session hijacking. Given the high CVSS scores, broad industry usage, and confirmed exploitation, treating these vulnerabilities as critical priorities is essential to safeguarding digital infrastructure and customer data from escalating cyber threats.

CISA says attackers are actively exploiting critical flaws in WSO2 and Adobe Commerce, along with additional issues in Microsoft SharePoint and Mikrotik RouterOS. Federal agencies must patch the critical KEV entries by September 27, while SharePoint and RouterOS fixes are due by September 28. #WSO2 #AdobeCommerce #MicrosoftSharePoint #MikrotikRouterOS #CVE-2026-5430 #CVE-2026-71362 #CVE-2026-65660 #CVE-2026-67279

CISA has added two critical vulnerabilities, CVE-2026-5430 in WSO2 products and CVE-2026-71362 in Adobe Commerce and Magento, to its Known Exploited Vulnerabilities catalog after evidence of active exploitation. The flaws can enable remote code execution or unauthorized access to sensitive customer data, and FCEB agencies must patch them by September 27,...

TL;DR On September 24, 2026, CISA updated its Known Exploited Vulnerabilities catalog with two high-risk security flaws. These critical CISA KEV vulnerabilities impact enterprise deployments of WSO2 and Adobe Commerce. Federal agencies and corporate administrators must remediate these flaws immediately to prevent network compromise. Why It Matters Sourced estimates show that tens of thousands of organizations deploy WSO2 middleware and Adobe Commerce storefronts globally.

This issue of The Cybersecurity Pulse covers major developments across security research, AI agents, and enterprise defenses, including a WeChat exploit chain, risky LG TV privacy behavior, and attackers exploiting StyleSmuggler in Magento and Adobe Commerce. It also highlights major industry moves such as CrowdStrike’s SecOps push, OpenAI’s GPT-6 Astra, Palo Alto Networks’ acquisition of Console, and ClickHouse’s acquisition of RunReveal. #WeChat #LG #StyleSmuggler #Magento #AdobeCommerce #CrowdStrike #OpenAIAstra #Console #RunReveal

Adobe Commerce pages that accept user input can store hidden code.

Adobe Commerce can store malicious code entered into certain form fields.

Microsoft’s latest Patch Tuesday set a new record with 973 disclosed bugs, including two actively exploited vulnerabilities tracked as CVE-2026-81963 and CVE-2026-85880. Researchers warned that thousands of unpatched Exchange servers and weaknesses in the Windows update stack could help attackers chain exploits into ransomware-style intrusions. #CVE-2026-81963 #CVE-2026-85880 #Microsoft #Windows #Exchange #AdobeCommerce...

Adobe released its September 2026 security update for Magento and Adobe Commerce, but merchants must separately install the CVE-2026-75650 StyleSmuggler emergency hotfix.

Adobe has released fixes for more than 170 vulnerabilities across its products, including a critical zero-day in Adobe Commerce and Magento Open Source that was actively exploited in the wild. The exploited flaw, tracked as CVE-2026-75650 and dubbed StyleSmuggler, enabled unauthenticated remote code execution, prompting urgent guidance to patch systems and...

Onlineshops auf Basis von Magento und Adobe Commerce sind offenbar aufgrund einer ungepatchten Sicherheitslücke namens StyleSmuggler angreifbar.

An unpatched, unauthenticated RCE zero-day called

Adobe Commerce can be tricked into processing specially crafted templates, which lets a remote attacker execute any code they choose on the system using.

Daily Recap, Attackers are actively leveraging multiple critical vulnerabilities, including N-able N-central CVE-2026-86218, an Adobe Commerce zero-day, and new MikroTik RouterOS bugs, to achieve RCE, plant backdoors, and hijack routers. Meanwhile, ConnectWise ScreenConnect is facing a worm-like file-transfer campaign, researchers revealed Nightmare Eclipse targeting CrowdStrike, Nvidia, and Avast, and Trezor reported breach impact affecting 81,000 customers. #CVE-2026-86218 #N-able #N-central #AdobeCommerce #MikroTik #RouterOS #ConnectWise #ScreenConnect #NightmareEclipse #CrowdStrike #Nvidia #Avast #Trezor #CCQ #SEP-2026