WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV
Summary: CISA added two critical flaws affecting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities catalog on Thursday, citing evidence of active exploitation. watchTowr reported forged JWT tokens targeting CVE-2026-5430 in its honeypots since at least September 13, 2026, while Sansec said it detected and blocked exploitation attempts against CVE-2026-71362 in August 2026.
What's compelling: WSO2 technology is used by nearly 1,000 customers across banking, government, telecommunications, and logistics, and federal agencies have until September 27, 2026, to apply fixes - a deadline that arrives after attackers have already had weeks to act.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-5430CVE-2026-71362
- Related
- CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability Known Exploited Vulnerabilities · Sep 24, 2026CVE-2026-5430: WSO2 Multiple Products Path Traversal Vulnerability Known Exploited Vulnerabilities · Sep 24, 2026