If your organization runs an internet-facing WSO2 API management platform or an Adobe Commerce / Magento storefront, this is your move-fast-and-fix-it moment. CISA just dropped two actively exploited vulnerabilities into its Known Exploited Vulnerabilities (KEV) catalog, and both demand immediate attention. Attackers are hitting unauthenticated, internet-exposed systems right now. The payoff ranges from full administrative takeover of your API gateway to complete customer-account takeover on your online store.

What CISA Added on September 24

On September 24, 2026, CISA added two new flaws to the KEV catalog based on confirmed exploitation in the wild:

• CVE-2026-5430 — WSO2 multiple products, path traversal / JWT authentication bypass (CVSS 10.0)
• CVE-2026-71362 — Adobe Commerce and Magento Open Source, incorrect authorization (CVSS 9.1)

Both are unauthenticated, internet-facing, and already being exploited. Under BOD 26-04, federal agencies must remediate CVE-2026-5430 by September 27, 2026. Treat that deadline as your own outer bound.

CVE-2026-5430: WSO2 API Management JWT Bypass

WSO2’s API management platform is what many organizations place between their applications and backend services to handle authentication and control API access. That is exactly why this one hurts so much.

The flaw lives in how the affected products validate JSON Web Tokens (JWTs). When a token is signed using an unsupported algorithm, the platform incorrectly accepts it. An attacker forges a JWT carrying administrative privileges, sends it to a vulnerable authentication endpoint, and the platform trusts it — no credentials required.

Security firm watchTowr first spotted in-the-wild attempts on September 13, with a forged JWT aimed at its honeypots. Replaying that same token against a real vulnerable instance worked. And the impact is the nasty part: full administrative access to the API platform. That exposes every API backend endpoint and its credentials, consumer keys and secrets for every registered application, plus a direct line to intercept traffic moving between your apps and internal systems. One researcher called it a lateral-movement-as-a-service opportunity for whoever gets in.

Affected products: API Manager 4.1.0 through 4.6.0, API Control Plane 4.5.0 and 4.6.0, Traffic Manager 4.5.0 and 4.6.0, Universal Gateway 4.5.0 and 4.6.0.
Fixed versions: API Control Plane 4.5.0.58+ and 4.6.0.22+, API Manager 4.1.0.257+.

CVE-2026-71362: Adobe Commerce / Magento Account Takeover

If you run an online store on Adobe Commerce or Magento Open Source, pay close attention — this is a customer-data disaster waiting to happen.

The bug is an incorrect-authorization flaw (CWE-863). The platform fails to properly bind a shopper’s identity to their session. Here is the exploit chain: the attacker submits a failed account edit that stores their raw input, and the platform later copies that stored data back into the session without filtering it. By injecting an id value into that data, the attacker overwrites the session’s real customer ID. The session check only confirms the customer record exists — it never verifies ownership, a password, or a token. The attacker’s session simply becomes the victim’s.

The attacker needs only a free throwaway account (self-registration is open by default on most stores) and network access. Once the switch happens, they can read the victim’s personal data, order history, saved addresses, and stored payment tokens. eCommerce security firm Sansec reported blocking live exploitation attempts within about a day of Adobe’s advisory.

Affected: Adobe Commerce 2.4.4–2.4.9, Magento Open Source 2.4.6–2.4.9, and Commerce B2B 1.3.3–1.5.3, at the July 2026 patch level and earlier.

Why Remediation Is Trickier Than It Looks

Both vendors shipped fixes months ago — WSO2 in May and Adobe in August via bulletin APSB26-92. Yet both are still being exploited. There are two reasons:

• Fix drift: CVE-2026-5430’s CVE record only went public in August, months after WSO2 patched it. Attackers waited for the write-up, then went hunting for unpatched servers.
• Adobe’s update model: The APSB26-92 fix ships as isolated patch files, not new Composer packages. A composer update will not pull it. Worse, the patch only applies cleanly if your store is already on the latest quarterly release for its branch. Fall behind on point releases and you face a two-step remediation — and a longer exposed window.

What You Should Do Right Now

1. Patch CVE-2026-5430 first. If you run any exposed WSO2 API Management product, get to the fixed versions immediately. Because the attack requires only network access, any internet-accessible instance is a target.
2. Understand Adobe’s patch requirement. For Magento / Adobe Commerce, confirm your base release is current before applying APSB26-92. Do not assume “we applied something” — verify the isolated patch actually took.
3. Assume prior compromise. Attackers were active before these were confirmed. Review web-server and application logs for file activity outside approved upload directories, unexpected admin accounts, suspicious child processes, and outbound connections. For stores, look for anomalous session switches and mass-assigned customer id parameters.
4. Rotate credentials. For WSO2, rotate API consumer keys and secrets if you have any reason to believe your instance was exposed — forged tokens can reach every registered application.
5. WAF it while you patch. Block the specific attack patterns — forged JWT signing algorithms and injected id parameters on customer edit endpoints — to buy time in the interim.

Neither of these CVEs is a weekend project. Both are unauthenticated, exploitable over the network, and already in the wild. Patch now, verify the fix, and audit for signs you were hit before the patch landed.