Attackers are exploiting critical flaws in two widely used pieces of business software: WSO2's API management platform and Adobe Commerce, the paid edition of the Magento online store software. The US Cybersecurity and Infrastructure Security Agency (CISA) added both to its Known Exploited Vulnerabilities (KEV) catalog on 24 September, based on evidence of active exploitation.
The deadline is unusually short. Federal civilian agencies have until 27 September, three days after the listing, to apply the vendors' mitigations, and CISA has flagged both entries for forensic triage, meaning agencies are expected to check whether they were compromised before patching. As usual, the alert does not name the attackers, describe the campaigns or say how many organizations have been hit, and that silence says nothing about the scale.
Two critical flaws, one in the API layer
Ordered by severity:
- CVE-2026-5430 (CVSS 10 in the National Vulnerability Database record, which notes an adjusted 9.8 for single-tenant deployments), affecting WSO2 API Control Plane, API Manager, Traffic Manager and Universal Gateway. CISA's catalog entry calls it a path traversal that could allow unrestricted file upload and lead to remote code execution, and classifies it under CWE-347, improper verification of a cryptographic signature. The NVD record describes the JWT authentication mechanism accepting tokens signed with algorithms other than those configured, which can lead to unauthorized access including takeover of administrative accounts. The two public descriptions emphasise different things, and WSO2's own advisory is the authoritative account of affected versions and fixes.
- CVE-2026-71362 (CVSS 9.1), an incorrect authorization flaw in Adobe Commerce and Magento that Adobe says could let an attacker gain elevated access to sensitive resources without user interaction. Adobe's bulletin APSB26-92 carries the affected versions and patches.
Neither vendor record describes how attackers are using these flaws in practice, so treat any exploit narrative as speculation until the vendors or responders publish more. CISA marks known ransomware use as unknown for both.
Why these two are worth moving on today
An API gateway sits in front of the services an organization exposes to partners and customers, so an authentication failure there is a failure at the front door of everything behind it. Online stores are a different kind of target: they process payment card data and customer accounts, which is why Magento shops have been a favourite of card-skimming crews for years.
This is the second KEV batch in three days. On 22 September CISA added flaws in Check Point, Arista, VeloCloud and F5 gear, which we covered here.
Apply WSO2's and Adobe's fixes, then look for intrusions
- Follow WSO2 advisory WSO2-2026-5328 for API Control Plane, API Manager, Traffic Manager and Universal Gateway, prioritising internet-facing instances.
- Apply Adobe's APSB26-92 update to Adobe Commerce and Magento installations.
- Because CISA asks federal agencies to check for compromise before patching, private organizations with exposed instances should do the same: review administrative account activity and recent changes on these systems for anything unexplained.
A three-day deadline is CISA's way of saying the window between disclosure and exploitation has already closed, and anyone running either product exposed to the internet should assume they are already being scanned.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.