#wso2
-
CISA Adds Exploited WSO2 and Adobe Commerce Flaws to Its KEV Catalog
The U.S. cybersecurity agency CISA has added two critical flaws in WSO2 and in Adobe Commerce and Magento to its KEV catalog, citing evidence of active attacks. Federal agencies must patch them by September 27, 2026.
-
Critical WSO2 API Manager Vulnerability Allowing Admin-Token Forgery Is Already Being Exploited
Researchers at watchTowr have observed active attacks against WSO2 API Manager: attackers bypass JWT validation and gain administrator privileges. The vulnerability has been assigned the maximum severity rating.