CISA Adds WSO2 and Adobe Commerce Flaws to Exploited List

CISA has added two actively exploited security flaws in WSO2 API management products and Adobe Commerce/Magento to its Known Exploited Vulnerabilities (KEV) catalog, the U.S. Cybersecurity and Infrastructure Security Agency announced on Thursday. The KEV catalog lists software vulnerabilities that federal civilian executive branch agencies must patch by a set deadline because attackers are already using them in real-world campaigns. The two newly listed flaws are CVE-2026-5430 in WSO2 and CVE-2026-71362 in Adobe Commerce and Magento.

CVE-2026-5430 carries a CVSS severity score of 9.8 out of 10 and is described as a path traversal vulnerability in WSO2 API Control Plane, API Manager, Traffic Manager and Universal Gateway. Path traversal is a type of weakness that lets an attacker use specially crafted requests to move outside the directories a web application is supposed to allow, and in this case it could allow unrestricted file upload and lead to remote code execution, which means an attacker can run their own commands on the affected server. Security firm watchTowr said it has been seeing in-the-wild exploitation attempts against its honeypots, which are decoy systems set up to observe attacks, since at least September 13, 2026. The attacker activity observed by watchTowr included forged JWT tokens, a standard type of digital credential, sent against the flaw. "We captured forged JWT tokens targeting the flaw on September 13 and reproduced the vulnerability ourselves, despite the lack of public technical details," Yordan Ganchev, principal threat intelligence specialist at watchTowr, said in a statement. "That gave us direct evidence that this wasn't merely a theoretical vulnerability or a critical severity score on paper. It was exploitable, and attackers were already acting on it." Ganchev added that WSO2 is not a niche target: its technology is used by nearly 1,000 customers across banking, government, telecommunications, and logistics, and organizations in those sectors cannot afford to wait for exploitation to be formally confirmed before patching.

The second flaw, CVE-2026-71362, has a CVSS score of 9.1 and is an incorrect authorization vulnerability in Adobe Commerce and Magento, the software Adobe owns for building online stores. It could allow an attacker to gain elevated access to sensitive resources without any user interaction, meaning an attacker does not need to trick a store employee or customer into clicking anything. Sansec, a Dutch e-commerce security company, said in August 2026 that it had detected and blocked exploitation attempts aimed at this flaw. "The vulnerability lets attackers switch a customer session to another customer account," Sansec explained. "This gives them access to the victim's account and private customer data." Previdian's telemetry indicates that a lone IP address from Australia attempted to exploit the flaw against its honeypot sensors on September 10, 2026. Adobe has yet to update its advisory to confirm exploitation status, so the CISA listing is based on outside observations rather than a vendor confirmation.

For website owners and IT teams, the two flaws highlight the same practical lesson: unpatched web platforms, whether they power APIs or online storefronts, are being targeted within days. If an organisation runs WSO2 API Manager or Adobe Commerce, it should apply the vendor's fixes now, not wait for a KEV deadline. Federal Civilian Executive Branch agencies have been advised to apply fixes for both vulnerabilities by September 27, 2026, but private companies face the same attackers and should move on the same timeline. The same patch discipline applies to any managed web platform: providers like AEU Hosting, which keeps the underlying WordPress installation updated and monitored, demonstrate the value of a proactive update cadence, and owners of Magento, WSO2 or similar platforms should insist on the same level of update management for their own deployments.

As these incidents show, attackers often act before a vendor advisory confirms an issue. Keeping automatic updates on, using a web application firewall in front of storefronts and APIs, and monitoring for unexpected account changes are low-cost measures that can reduce the window of exposure. The KEV listing is a signal, not the starting gun: by the time a flaw appears there, attackers have already had days or weeks to work.