CISA Adds Exploited WSO2 and Adobe Commerce Flaws to Its KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The flaws affect WSO2 products as well as Adobe Commerce and Magento.

Two critical holes

The first flaw, CVE-2026-5430 (CVSS score 9.8), is a path traversal vulnerability in WSO2 API Control Plane, API Manager, Traffic Manager and Universal Gateway. It allows unrestricted file upload and can ultimately lead to remote code execution.

The second, CVE-2026-71362 (CVSS 9.1), stems from incorrect authorization in Adobe Commerce and Magento. An attacker can gain elevated access to sensitive resources without any user interaction.

What is known about the attacks

CVE-2026-5430 was added a little over a week after watchTowr reported exploitation attempts against its honeypots dating back to at least September 13, 2026.

For CVE-2026-71362, the Dutch e-commerce security firm Sansec detected and blocked exploitation attempts as early as August 2026. According to the company, the flaw lets attackers switch one customer's session to another customer's account, gaining access to the victim's account and private data. Telemetry from Previdian shows that a lone IP address from Australia tried to exploit the flaw against its honeypot sensors on September 10, 2026. Adobe has yet to update its advisory to confirm the exploitation status.

Deadline for agencies

Federal Civilian Executive Branch (FCEB) agencies are required to apply fixes for both vulnerabilities by September 27, 2026, to protect their networks against current threats.

Source: The Hacker News