CISA Warns of Exploited Flaws in WSO2, Adobe Commerce, SharePoint and RouterOS
Summary
CISA added critical WSO2 and Adobe Commerce flaws to its KEV catalog and reported exploitation of SharePoint and RouterOS flaws. Federal agencies face September 27 and 28 remediation deadlines.
Key points
- CISA added critical WSO2 vulnerability CVE-2026-5430 and Adobe Commerce/Magento vulnerability CVE-2026-71362 to its Known Exploited Vulnerabilities catalog.
- CVE-2026-5430 affects specified WSO2 products and versions; the vendor says exploitation could compromise administrative accounts and give attackers full control.
- The WSO2 flaw stems from JWT authentication accepting tokens signed with an unsupported algorithm.
- watchTowr reported a limited number of exploitation attempts against the wrong WSO2 product; researchers reproduced the attack against the correct product.
- Sansec observed CVE-2026-71362 being exploited in the wild; it affects Adobe Commerce and Magento.
- CISA said attackers are also exploiting a SharePoint code-injection flaw, CVE-2026-65660, and a Mikrotik RouterOS workflow-bypass flaw, CVE-2026-67279.
- Federal agencies were given until September 27 to address the two critical KEV flaws and September 28 for the SharePoint and RouterOS issues; CISA encouraged all organizations to act.
Article Details
- Vulnerability Types
- Authentication bypass
- Incorrect authorization
- Code injection
- Pre-authentication SSH state-machine/workflow bypass
- Affected Versions
- WSO2 API Manager 4.1.0 through 4.6.0
- WSO2 API Control Plane 4.5.0 and 4.6.0
- WSO2 Traffic Manager 4.5.0 and 4.6.0
- WSO2 Universal Gateway 4.5.0 and 4.6.0
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- unknown
- Workarounds
- Apply the recommended updates or mitigations, or discontinue use of affected products.
CVE
People
Vendors
AdobeCISA says attackers are actively exploiting critical flaws in WSO2 and Adobe Commerce, along with additional issues in Microsoft SharePoint and Mikrotik RouterOS.MicrosoftCISA says attackers are actively exploiting critical flaws in WSO2 and Adobe Commerce, along with additional issues in Microsoft SharePoint and Mikrotik RouterOS.MikroTikCISA says attackers are actively exploiting critical flaws in WSO2 and Adobe Commerce, along with additional issues in Microsoft SharePoint and Mikrotik RouterOS.WSO2CISA says attackers are actively exploiting critical flaws in WSO2 and Adobe Commerce, along with additional issues in Microsoft SharePoint and Mikrotik RouterOS.
Products
Adobe CommerceCISA says attackers are actively exploiting critical flaws in WSO2 and Adobe Commerce, along with additional issues in Microsoft SharePoint and Mikrotik RouterOS.API Control PlaneThe CVE-2026-5430 flaw received a maximum severity score and impacts WSO2 API Manager versions 4.1.0 through 4.6.0, API Control Plane, Traffic Manager, and Universal Gateway versions 4.5.0 and 4.6.0.MagentoCISA also listed CVE-2026-71362 affecting Adobe Commerce and Magento.Microsoft SharePointCISA says attackers are actively exploiting critical flaws in WSO2 and Adobe Commerce, along with additional issues in Microsoft SharePoint and Mikrotik RouterOS.MikroTik RouterOSCISA says attackers are actively exploiting critical flaws in WSO2 and Adobe Commerce, along with additional issues in Microsoft SharePoint and Mikrotik RouterOS.Traffic ManagerThe CVE-2026-5430 flaw received a maximum severity score and impacts WSO2 API Manager versions 4.1.0 through 4.6.0, API Control Plane, Traffic Manager, and Universal Gateway versions 4.5.0 and 4.6.0.Universal GatewayThe CVE-2026-5430 flaw received a maximum severity score and impacts WSO2 API Manager versions 4.1.0 through 4.6.0, API Control Plane, Traffic Manager, and Universal Gateway versions 4.5.0 and 4.6.0.WSO2 API ManagerThe CVE-2026-5430 flaw received a maximum severity score and impacts WSO2 API Manager versions 4.1.0 through 4.6.0, API Control Plane, Traffic Manager, and Universal Gateway versions 4.5.0 and 4.6.0.
Industries
Banking“Its technology is used by nearly 1,000 customers across banking, government, telecommunications, and logistics,” explained Ganchev.E-commerceThe second critical-severity bug added to the KEV is CVE-2026-71362, an incorrect authorization vulnerability in Adobe’s Commerce and Magento e-commerce platforms.Government“Its technology is used by nearly 1,000 customers across banking, government, telecommunications, and logistics,” explained Ganchev.logistics“Its technology is used by nearly 1,000 customers across banking, government, telecommunications, and logistics,” explained Ganchev.Telecommunications“Its technology is used by nearly 1,000 customers across banking, government, telecommunications, and logistics,” explained Ganchev.