CISA adds actively exploited WSO2 and Adobe Commerce flaws to its Known Exploited Vulnerabilities catalog

TLDR

• CISA added two actively exploited flaws to its Known Exploited Vulnerabilities catalog: CVE-2026-5430 in WSO2's API Manager and gateway products, and CVE-2026-71362 in Adobe Commerce and Magento.
• Sources differ on the WSO2 flaw's exact mechanism: BleepingComputer describes an authentication bypass via a JWT algorithm flaw, while The Hacker News describes a path traversal issue with a 9.8 CVSS score.
• The Adobe Commerce flaw lets attackers hijack a customer's session with no account or user interaction needed; security firm Sansec has already blocked live exploitation attempts.
• US federal civilian agencies must apply fixes for both by 27 September 2026.

CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog this week after confirming active exploitation: CVE-2026-5430, affecting WSO2's API Control Plane, API Manager, Traffic Manager and Universal Gateway, and CVE-2026-71362, an incorrect authorisation flaw in Adobe Commerce and Magento.¹² BleepingComputer reports that CVE-2026-5430 stems from WSO2's JWT authentication mechanism accepting tokens signed with an unsupported algorithm, letting attackers bypass authentication.² The Hacker News describes the same flaw as a path traversal issue enabling unrestricted file upload that could lead to remote code execution, and puts its CVSS score at 9.8.¹ Security firm watchTowr says its honeypots captured forged JWT tokens targeting the flaw as early as 13 September, and flagged WSO2's reach across roughly 1,000 customers in banking, government, telecommunications and logistics.¹

The Adobe Commerce flaw lets an attacker switch a legitimate customer's session to another customer's account, with no existing account, administrator privileges or user interaction required, exposing that victim's data.¹² Security firm Sansec detected and blocked exploitation attempts in August, and Adobe has not yet updated its advisory to confirm exploitation status.¹ CISA has given US federal civilian agencies until 27 September 2026 to apply fixes for both flaws.¹²

Why it matters: both flaws sit in software running quietly behind large numbers of enterprise APIs and online stores, so exploitation can expose or hijack customer data at scale before most organisations notice a problem, and the tight one-week remediation window signals CISA sees the in-the-wild activity as serious.