CISA has added two vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming evidence of active exploitation: CVE-2026-5430 affecting multiple WSO2 API-management products and CVE-2026-71362 affecting Adobe Commerce and Magento Open Source.

Both vulnerabilities deserve urgent attention because they affect systems that are commonly exposed to the Internet and frequently operate close to sensitive business functions. WSO2 API-management platforms sit directly in front of application interfaces, authentication flows, and service-to-service traffic, while Adobe Commerce and Magento installations commonly handle customer accounts, orders, payment-related workflows, and administrative functions.

The combination of Internet exposure, unauthenticated exploitation, and high technical impact makes both vulnerabilities particularly attractive to attackers.

CVE-2026-5430: Critical WSO2 authentication bypass

CVE-2026-5430 affects WSO2 API Manager, API Control Plane, Traffic Manager, Universal Gateway, and related components.

WSO2's own advisory describes the vulnerability as a JWT authentication bypass caused by improper handling of unsupported signing algorithms. A specially crafted token signed using an unsupported algorithm may be accepted when it should instead be rejected.

An attacker able to exploit this condition can bypass authentication and obtain unauthorized access, including potentially compromising administrative accounts.

The vulnerability carries a maximum CVSS score of 10.0 in some deployment scenarios, with no authentication or user interaction required.

Affected WSO2 API Manager versions include branches from 4.1.0 through 4.6.0, with corresponding fixes provided through updated product levels.

The significance of this vulnerability goes well beyond access to a single application account. API-management platforms often sit at a strategic point in enterprise architecture. They may manage authentication, API keys, routing, policy enforcement, backend service connectivity, rate limiting, and administrative access across many applications.

If an attacker obtains high-privilege access to that layer, the compromise can potentially expose far more than the WSO2 server itself. It may provide visibility into internal APIs, credentials, configuration, backend systems, and trust relationships.

An important discrepancy exists in the CISA description

There is an interesting inconsistency worth highlighting.

CISA's KEV entry labels CVE-2026-5430 as a path traversal vulnerability that could allow unrestricted file upload and remote code execution.

However, WSO2's official security advisory and the CVE record describe CVE-2026-5430 as a JWT authentication bypass caused by an algorithm-validation issue, leading to potential account takeover.

For defenders, the important point is that CISA's inclusion confirms active exploitation, while WSO2's official advisory should be treated as the authoritative source for the technical root cause, affected versions, and remediation.

This type of discrepancy is exactly why vulnerability response should not rely solely on one-line descriptions in aggregation feeds. The CVE identifier may be correct while the short description contains inconsistent or outdated characterization.

Why the WSO2 flaw is particularly serious

An API management system is not an ordinary application server.

It frequently sits between external users and critical backend services. Administrative access can expose API definitions, credentials, integration configurations, tokens, internal endpoints, and policy settings.

An attacker who gains control of the API-management layer may potentially manipulate requests, alter routing, create unauthorized users or tokens, expose internal services, or interfere with security policies.

That makes active exploitation of a pre-authentication flaw in such a product especially concerning.

Organizations should therefore treat CVE-2026-5430 not simply as another application vulnerability, but as a potential control-plane compromise.

CVE-2026-71362: Adobe Commerce and Magento authorization failure

The second newly added KEV entry, CVE-2026-71362, affects Adobe Commerce, Adobe Commerce B2B, and Magento Open Source.

Adobe describes the vulnerability as an incorrect authorization issue that can allow an unauthenticated attacker to gain elevated access to sensitive resources.

The vulnerability carries a CVSS score of 9.1, requires no authentication, and does not require user interaction.

Adobe's August 11 security bulletin initially stated that the company was not aware of exploitation in the wild. That situation has clearly changed. CISA's September 24 addition now confirms evidence of active exploitation.

This timeline is important because it demonstrates how quickly the risk profile of a vulnerability can change after public disclosure.

A vulnerability may begin as:

critical but not known to be exploited

and later become:

confirmed active threat

without any change to the underlying bug.

The only thing that changes is attacker adoption.

Adobe Commerce systems are attractive targets for obvious reasons

E-commerce platforms hold particularly valuable data and functionality.

Depending on configuration, an Adobe Commerce or Magento environment may contain customer profiles, order history, email addresses, shipping information, account credentials, administrative functions, API integrations, payment-provider connections, and access to backend business systems.

A vulnerability that enables privilege escalation or unauthorized access can therefore support multiple attack objectives.

Potential consequences may include account takeover, customer-data access, administrative manipulation, fraudulent orders, malicious content injection, or further compromise of connected systems.

Not every successful exploit will produce all of those outcomes, but the platform's position inside the business makes unauthorized privilege escalation inherently serious.

Adobe released fixed versions in August

Adobe addressed CVE-2026-71362 in its August 2026 security updates.

Affected Adobe Commerce branches include versions through the July 2026 security releases, while the corresponding August 2026 releases contain the fix.

Examples include:

Adobe Commerce:
2.4.9-2026-aug
2.4.8-2026-aug
2.4.7-2026-aug
2.4.6-2026-aug
2.4.5-2026-aug
2.4.4-2026-aug

Magento Open Source:
2.4.9-2026-aug
2.4.8-2026-aug
2.4.7-2026-aug
2.4.6-2026-aug

Adobe Commerce B2B also received corresponding August releases.

Organizations still running the affected July builds or earlier should consider remediation urgent.

Active exploitation changes the response

The most important aspect of a KEV listing is that it changes the question defenders should ask.

Before active exploitation is confirmed, the question is often:

“How quickly should we patch this?”

After KEV inclusion, the question becomes:

“Were we already compromised before we patched?”

That distinction matters.

Applying an update closes the vulnerability going forward.

It does not erase evidence of access that may already have occurred.

For both WSO2 and Adobe Commerce systems that remained exposed before remediation, organizations should therefore combine patching with compromise assessment.

WSO2 environments require authentication and configuration review

For WSO2, administrators should review authentication events for unusual JWT usage, unexpected administrative access, recently created accounts, modified API definitions, policy changes, and suspicious configuration modifications.

Security teams should also inspect backend-service access for activity that would be unusual for legitimate API clients.

Because the vulnerability concerns authentication bypass, traditional failed-login monitoring may not necessarily capture the attack. A successful malicious token may look like successful authentication rather than a rejected attempt.

That makes behavioral analysis and administrative audit logs particularly important.

Adobe Commerce environments should be checked for account and privilege anomalies

Organizations running Adobe Commerce or Magento should review customer and administrator activity around the period before patching.

Useful indicators include unexpected account changes, privilege modifications, new administrative users, unusual sessions, abnormal API access, changes to orders or customer records, unfamiliar integrations, and modifications to extensions or configuration.

If unauthorized privilege escalation occurred, secondary activity may be more visible than the original exploit itself.

Defenders should therefore avoid searching only for one known exploit request.

KEV prioritization is increasingly more useful than CVSS alone

These two additions also illustrate why vulnerability management cannot be based solely on CVSS scoring.

Both vulnerabilities are severe, but the more important signal is that attackers are actually using them.

A CVSS 10 vulnerability with no exposure may present less immediate organizational risk than a lower-scored vulnerability being actively exploited against an exposed production asset.

CISA's KEV catalog helps defenders add an exploitation dimension to vulnerability prioritization.

The useful equation is increasingly:

severity + exposure + exploitation + business criticality

rather than simply:

CVSS score

CISA's newer BOD emphasizes this risk-based approach

CISA's Binding Operational Directive BOD 26-04 requires U.S. federal civilian agencies to prioritize remediation based on factors including KEV status, Internet exposure, and potential post-exploitation impact.

The September 24 KEV entries carry a federal remediation due date of September 27, 2026, underscoring the urgency CISA attaches to actively exploited vulnerabilities with significant technical impact.

Although those requirements apply specifically to U.S. federal agencies, the prioritization model is useful for any organization.

Publicly exposed systems with confirmed exploitation should move ahead of ordinary patch queues.

Patch management should be paired with exposure management

Both vulnerabilities reinforce another recurring lesson: organizations need to know not only what software they run, but where it is reachable from.

An internal WSO2 instance accessible only through a tightly controlled management network presents a very different risk profile from an API gateway exposed directly to the Internet.

Similarly, an externally accessible Magento store represents a very different attack surface from an isolated development instance.

Asset inventory without exposure context is incomplete.

Organizations should therefore identify:

  • affected software versions;
  • Internet-facing instances;
  • administrative interfaces;
  • authentication boundaries;
  • business criticality;
  • patch status; and
  • evidence of suspicious activity.

That combination allows defenders to prioritize the assets most likely to be targeted.

The broader cybersecurity lesson

The September 24 KEV additions illustrate two different but equally dangerous classes of vulnerability.

WSO2's flaw affects the identity and control plane of API infrastructure.

Adobe Commerce's flaw affects the authorization model of Internet-facing commerce platforms.

Both can be attacked remotely.

Both require no user interaction.

And both are now confirmed to be exploited.

That combination should move them out of ordinary maintenance queues.

The practical response is:

identify affected systems → determine Internet exposure → patch immediately → review logs and configuration → investigate suspicious activity → rotate credentials where compromise is suspected.

The central lesson remains painfully consistent: once CISA adds a vulnerability to KEV, defenders are no longer discussing whether attackers might exploit it.

Someone already is.

At that point, patching is only half the job.

The other half is determining whether the attacker arrived first.

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability CVE-2026-71362 Adobe Commerce and Magento Incorrect Authorization Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities . CISA will continue to add vulnerabilities to the catalog that meet the specified criteria . Aware of an exploited vulnerability not currently listed in th

Source: CISA Adds Two Known Exploited Vulnerabilities to Catalog via CISA Advisories — published 24 Sep 2026.