Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

CISA Warns of Exploited WSO2 and Adobe Commerce Flaws

Part of the CVE-2026-5430 story · since 30 Jun

Quiet for 7 weekslast report 25 Sep6 articles4 outlets
30 Jun · SecurityOnline first6 Sep29 Sep22 OctNowThis article5th of 6
  • Tue 30 Jun, 04:11 UTC. SecurityOnline, first report. WSO2 patches critical JWT bypass flaw, putting bank APIs at risk. Cites a CVE in CISA KEV.
  • Fri 7 Aug, 14:02 UTC. SecurityOnline. WSO2 Flaws Enable Account Takeover Via JWT Bypass, Patch Urged. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 09:00 UTC. SecurityWeek, its first report on the story. Critical WSO2 Flaw Exploited to Steal API Credentials and Secrets. Cites a CVE in CISA KEV.
  • Thu 24 Sep, 20:01 UTC. CISA, its first report on the story. CISA Warns of Active Exploits Targeting Critical WSO2 Flaw. Cites a CVE in CISA KEV.
  • Fri 25 Sep, 03:47 UTC. SecurityOnline. CISA Warns of Exploited WSO2 and Adobe Commerce Flaws. Cites a CVE in CISA KEV. This article, 5th of 6.
  • Fri 25 Sep, 09:30 UTC. Security Affairs, its first report on the story. CISA Flags Critical WSO2 and Magento Flaws Used in Attacks. Cites a CVE in CISA KEV.

On 24 September 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities affecting WSO2 products and Adobe Commerce to its Known Exploited Vulnerabilities (KEV) catalogue. The agency’s listing indicates that both flaws are being exploited, although the supplied report does not provide details of the attacks.

CVE-2026-5430 has a CVSS score of 10.0 and affects WSO2 API Manager versions 4.1.0 to 4.6.0, as well as API Control Plane, Traffic Manager and Universal Gateway versions 4.5.0 and 4.6.0. CVE-2026-71362, rated 9.1, affects Adobe Commerce and Magento Open Source versions 2.4.4 to 2.4.9 where the August 2026 security updates have not been installed.

The report says CVE-2026-5430 results from defective JSON Web Token verification. An unauthenticated attacker can submit a token using an unsupported signing algorithm, which the server may accept and use to bypass authentication. CVE-2026-71362 is described as an authorisation flaw that can allow access to restricted resources without user interaction. No public proof-of-concept code has reportedly been observed, but internet-facing unpatched systems are described as at risk of account takeover.

Administrators should apply the relevant WSO2 fixes or product updates and install Adobe’s August 2026 security releases. The report says US federal civilian agencies must remediate both vulnerabilities by 27 September 2026.

How the story developed

All 6 articles
Quiet for 7 weekslast report 25 Sep6 articles4 outlets

6 articles from 4 outlets since 30 Jun. Quiet since 25 Sep. This was the 5th report, 87 days after the first.

Now30 Jun6 Aug915 Sep192225First reportSecurityOnline · 30 Jun, 04:11This article5th of 6 · day 87
  • Tue 30 Jun, 04:11 UTC. SecurityOnline, first report. WSO2 patches critical JWT bypass flaw, putting bank APIs at risk. Cites a CVE in CISA KEV.
  • Fri 7 Aug, 14:02 UTC. SecurityOnline. WSO2 Flaws Enable Account Takeover Via JWT Bypass, Patch Urged. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 09:00 UTC. SecurityWeek, its first report on the story. Critical WSO2 Flaw Exploited to Steal API Credentials and Secrets. Cites a CVE in CISA KEV.
  • Thu 24 Sep, 20:01 UTC. CISA, its first report on the story. CISA Warns of Active Exploits Targeting Critical WSO2 Flaw. Cites a CVE in CISA KEV.
  • Fri 25 Sep, 03:47 UTC. SecurityOnline. CISA Warns of Exploited WSO2 and Adobe Commerce Flaws. Cites a CVE in CISA KEV. This article, 5th of 6.
  • Fri 25 Sep, 09:30 UTC. Security Affairs, its first report on the story. CISA Flags Critical WSO2 and Magento Flaws Used in Attacks. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 6 articles as a list
  1. Tue 30 JunDay 01
    1. WSO2 patches critical JWT bypass flaw, putting bank APIs at risk04:11 · SecurityOnline · First report · Exploited CVE · Known exploited CVE

  2. Quiet for 5 weeks

    Fri 7 AugDay 381
    1. WSO2 Flaws Enable Account Takeover Via JWT Bypass, Patch Urged14:02 · SecurityOnline · Picked up again · Known exploited CVE

  3. Quiet for 6 weeks

    Wed 16 SepDay 781
    1. Critical WSO2 Flaw Exploited to Steal API Credentials and Secrets09:00 · SecurityWeek · Picked up again · Known exploited CVE

  4. Quiet for 8 days

    Thu 24 SepDay 861
    1. CISA Warns of Active Exploits Targeting Critical WSO2 Flaw20:01 · CISA · official · CISA alert · Picked up again · Known exploited CVE
  5. Fri 25 SepDay 872
    1. CISA Warns of Exploited WSO2 and Adobe Commerce Flaws03:47 · SecurityOnline · Known exploited CVE · This article, 5th of 6
    2. CISA Flags Critical WSO2 and Magento Flaws Used in Attacks09:30 · Security Affairs · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in