CISA Adds Two Actively Exploited WSO2 and Adobe Commerce Vulnerabilities to KEV Catalog
Summary
CISA added two actively exploited vulnerabilities—affecting WSO2 products and Adobe Commerce/Magento—to its KEV Catalog and urges organizations to prioritize risk-based remediation.
Key points
- CVE-2026-5430 affects multiple WSO2 products and is a path traversal vulnerability.
- CVE-2026-71362 affects Adobe Commerce and Magento and involves incorrect authorization.
- CISA says both vulnerabilities were added to the KEV Catalog based on evidence of active exploitation.
- BOD 26-04 requires FCEB agencies to prioritize remediation of specified high-risk KEV vulnerabilities on publicly exposed assets and to check for possible compromise before patching.
- CISA encourages all organizations to prioritize KEV vulnerabilities using risk-based vulnerability management.
- CISA says nominations for potential KEV additions must include a CVE ID, evidence of exploitation, and clear mitigation guidance.
Article Details
- Vulnerability Types
- Path traversal
- Incorrect authorization
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- unknown