CISA KEV Adds WSO2 CVE-2026-5430 and Adobe Commerce CVE-2026-71362: Patch Guide

By AiCybr Editorial · Published September 26, 2026

CISA added CVE-2026-5430, affecting multiple WSO2 API products, and CVE-2026-71362, affecting Adobe Commerce and Magento Open Source, to its Known Exploited Vulnerabilities catalog on September 24, 2026 after finding evidence of active exploitation. The KEV entries set September 27, 2026 as the remediation due date for U.S. Federal Civilian Executive Branch agencies.

WSO2 rates CVE-2026-5430 Critical and documents an unauthenticated JWT authentication bypass that can lead to unauthorized access and account takeover. Adobe classifies CVE-2026-71362 as a Critical incorrect-authorization vulnerability in the August APSB26-92 security update. Operators of affected deployments should apply the vendor fixes or move to an unaffected release and then review exposed systems for signs of compromise.

The September KEV status is newer than the original Adobe bulletin. APSB26-92, published August 11, stated that Adobe was unaware of in-the-wild exploitation at that time; CISA's September 24 addition establishes a later active-exploitation status for CVE-2026-71362.

The two KEV entries at a glance

CISA's KEV catalog is an exploitation-prioritization signal. The September 27 deadline applies directly to FCEB agencies under the applicable binding operational directive; other organizations can use KEV status as a strong patch-priority indicator.

CVE-2026-5430: WSO2 affected products and fixes

WSO2 advisory WSO2-2026-5328 lists the following affected product lines:

• WSO2 API Control Plane 4.6.0 and 4.5.0;
• WSO2 API Manager 4.6.0, 4.5.0, 4.4.0, 4.3.0, 4.2.0 and 4.1.0;
• WSO2 Traffic Manager 4.6.0 and 4.5.0;
• WSO2 Universal Gateway 4.6.0 and 4.5.0.

The vendor describes the flaw as an authentication bypass in JWT processing: a token signed using an unsupported algorithm can be accepted, enabling unauthorized access. WSO2 says successful exploitation can compromise administrative accounts and lead to full account takeover.

WSO2 gives the vulnerability a CVSS 3.1 score of 10.0 for the general case and 9.8 for single-tenant deployments, where impact remains within one security-authority boundary.

For support-subscription customers, WSO2 lists minimum update levels for the affected branches:

Community users can apply WSO2's public fixes or migrate to the latest unaffected product version. The exact vendor advisory should be used to choose the fix path for each deployed branch.

A wording discrepancy worth preserving

CISA's KEV entry labels CVE-2026-5430 a WSO2 Multiple Products Path Traversal Vulnerability and describes a path-traversal condition associated with unrestricted file upload and remote-code-execution impact. WSO2's advisory for the same CVE instead documents a JWT authentication bypass caused by acceptance of an unsupported signing algorithm.

These are materially different technical descriptions attached to the same CVE identifier. Until the authoritative records converge, incident teams should preserve both descriptions in detection and remediation notes and use WSO2's published update guidance for the affected product branches.

CVE-2026-71362: Adobe Commerce and Magento

Adobe addressed CVE-2026-71362 in APSB26-92, its August 11 security update for Adobe Commerce and Magento Open Source. Adobe classifies the issue as Critical, maps it to CWE-863: Incorrect Authorization, and says the security update addresses vulnerabilities capable of security-feature bypass, arbitrary code execution and privilege escalation across the bulletin's issue set.

APSB26-92 lists affected Adobe Commerce branches through the July 2026 patch levels, including the 2.4.9, 2.4.8, 2.4.7, 2.4.6, 2.4.5 and 2.4.4 families, along with affected Adobe Commerce B2B branches. Administrators should use Adobe's current APSB26-92 table to map their exact installed build to the fixed release or isolated patch.

Adobe also provides an isolated patch for the APSB26-92 issues so merchants can remediate without waiting for a broader application upgrade where that is operationally preferable.

What operators should do now

For WSO2 environments, inventory every internet-facing and internal API Manager, API Control Plane, Traffic Manager and Universal Gateway instance. Record the exact product version and update level, then apply the minimum fixed update level or a newer unaffected release. Because exploitation is confirmed at the KEV level, patching should be paired with review of authentication activity, administrative-account changes and other security telemetry around exposed instances.

For Adobe Commerce and Magento Open Source, identify the exact Commerce/Magento and B2B build, compare it with APSB26-92, and apply the vendor security update or isolated patch. Review privileged-account activity, unexpected authorization changes, administrative sessions and application/infrastructure logs for anomalous access around the period before remediation.

Where credentials, sessions or administrative access may have been exposed, invalidate affected sessions and rotate credentials based on the incident evidence and the organization's response policy. Preserve relevant logs before cleanup when an investigation is required.

Exploitation status and prioritization

CISA's September 24 KEV addition establishes that both CVEs have evidence of exploitation in the wild. The catalog currently lists ransomware use as Unknown, so ransomware attribution should not be inferred from KEV inclusion.

For organizations outside the U.S. federal scope, the September 27 date is still useful as an urgency marker. Internet-facing WSO2 API infrastructure and public commerce systems are high-value targets, and both vendors already provide remediation paths.

Bottom line

CVE-2026-5430 and CVE-2026-71362 have moved from ordinary vendor-advisory status to CISA's actively exploited catalog. WSO2 operators should verify product update levels against WSO2-2026-5328, while Adobe Commerce and Magento operators should map their installed builds to APSB26-92 and apply the appropriate update or isolated patch. Incident review is warranted for exposed systems that remained vulnerable during the exploitation window.

Sources

• CISA, September 24 KEV alert: https://www.cisa.gov/news-events/alerts/2026/09/24/cisa-adds-two-known-exploited-vulnerabilities-catalog
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• WSO2 Security Advisory WSO2-2026-5328 / CVE-2026-5430: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/
• Adobe Security Bulletin APSB26-92: https://helpx.adobe.com/security/products/magento/apsb26-92.html
• Adobe APSB26-92 isolated-patch guidance: https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-40380
• Independent current corroboration, BleepingComputer: https://www.bleepingcomputer.com/news/security/cisa-warns-of-sharepoint-wso2-adobe-commerce-flaws-exploited-in-attacks/