- CISA added two critical flaws to its exploited-vulnerability list, one in WSO2 products (CVE-2026-5430) and one in Adobe Commerce and Magento (CVE-2026-71362), plus a SharePoint bug and a RouterOS bug.
- Security firm watchTowr saw forged-token attempts against WSO2 on September 13 and, in its own test, used a forged token to pull application credentials. Sansec says the Adobe flaw needs no account.
- Check whether you run the named WSO2, Adobe Commerce, SharePoint or RouterOS versions, patch or mitigate them, review logs back to the May 3 advisory, and rotate stored credentials.
The Cybersecurity and Infrastructure Security Agency (CISA) has added two critical-severity vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, BleepingComputer reported. One is CVE-2026-5430, an authentication bypass in multiple WSO2 products. The other is CVE-2026-71362, an incorrect authorization flaw in Adobe Commerce and Magento. CISA's same update lists two more actively exploited bugs: a high-severity SharePoint code-injection issue, CVE-2026-65660, and a medium-severity flaw in Mikrotik RouterOS, CVE-2026-67279, that lets an attacker skip authentication before login.
For the two critical issues, federal agencies have until Sunday, September 27 to apply updates or mitigations, or to discontinue use. The SharePoint and RouterOS deadline is Monday, September 28. Those dates bind federal agencies. CISA also encourages all organizations to prioritize the issues listed in the KEV.
WSO2: a forged token was enough in testing
CVE-2026-5430 received a maximum severity score. The exposure spans WSO2 API Manager releases 4.1.0 up to 4.6.0, along with the 4.5.0 and 4.6.0 builds of three related components: API Control Plane, Traffic Manager and Universal Gateway. At the root of the bug: the login system will accept a JWT token even when it's signed with an algorithm it isn't supposed to trust. WSO2's own advisory, published May 3, warned that exploitation could hand an attacker administrative access and complete control of the system.
CISA has not released technical details of the attacks it is tracking. Separately, security firm watchTowr disclosed on September 15 that its honeypot systems had picked up exploitation attempts — a handful of forged-token requests traced to a single IP address on September 13. That particular attacker had aimed at the wrong WSO2 product for CVE-2026-5430. To confirm the risk was real, watchTowr built its own version of the attack against the correct product and found a forged token was sufficient to reach API endpoints and pull application credentials.
Yordan Ganchev, who works threat intelligence at watchTowr, pushed back on the idea that this is a niche target when he spoke with BleepingComputer. "Its technology is used by nearly 1,000 customers across banking, government, telecommunications, and logistics," he said. He added: "Organizations in these sectors can't afford to wait for exploitation to be formally confirmed."
Adobe Commerce: no account required
CVE-2026-71362 affects Adobe's Commerce and Magento e-commerce platforms. E-commerce security company Sansec observed it being exploited in the wild. Sansec said threat actors require "no existing account, administrator privileges, or user interaction" to use it. For a retailer, that means the flaw is reachable without any credential the organisation issued.
What this means for the budget
The WSO2 sequence is specific and documented, though narrow. The vendor published its advisory on May 3. A single IP address's forged-token requests, logged by watchTowr on September 13, mark the first exploitation attempt captured publicly. CISA's listing followed. Those attempts hit the wrong product, and watchTowr's reproduction on the correct one showed credential exposure. Organisations running affected WSO2 versions that waited for a KEV entry would have left the gateway exposed through the interval between advisory and listing. The source does not say when a fix became available relative to the May 3 advisory, so the length of that exposure depends on each organisation's version and patch options.
The four products span an API gateway, a commerce platform, a collaboration server and a network router. Do you know who owns each one inside your organisation?
Questions for your team this week
1. Do we run WSO2 API Manager 4.1.0 through 4.6.0, or the 4.5.0 and 4.6.0 components named above? If so, which are internet-facing, and has each been updated or mitigated?
2. For any exposed WSO2 instance, have we reviewed logs for forged JWT tokens back to the May 3 advisory date, or to the earliest retention we hold? September 13 is only the first documented attempt, not a confirmed start of exploitation. Have we also rotated the application credentials and API keys stored behind the instance?
3. Do we operate Adobe Commerce or Magento, and has CVE-2026-71362 been addressed? Who owns that decision, our team or an agency?
4. Do we have SharePoint (CVE-2026-65660) or RouterOS (CVE-2026-67279) in scope, and are we tracking the September 28 federal date as a benchmark for our own timeline?
5. When a vendor advisory names a maximum-severity authentication flaw, what is our stated time to patch, and is it tied to the advisory date rather than to a KEV listing?
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: BleepingComputer.
