Quick Takeaways
- Attackers are actively exploiting a critical path traversal flaw in WSO2 products (CVE-2026-5430) to gain remote code execution, with evidence of in-the-wild attacks since September 13, 2026.
- A high-severity flaw in Adobe Commerce and Magento (CVE-2026-71362) allows session hijacking and unauthorized access to sensitive customer data, with detected exploitation attempts.
- Organizations using these platforms are urged to patch immediately by September 27, 2026, to prevent compromise from ongoing cyberattacks.
Threat, Attack Techniques, and Targets
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two critical security flaws to its Known Exploited Vulnerabilities (KEV) list. These flaws are actively being exploited. The first vulnerability, CVE-2026-5430, affects WSO2 products such as API Control Plane, API Manager, Traffic Manager, and Universal Gateway. It is a path traversal flaw with a high severity score of 9.8. Attackers can upload files without restriction and execute remote code on affected systems. The second vulnerability, CVE-2026-71362, impacts Adobe Commerce and Magento. It allows attackers to gain higher access levels by abusing incorrect authorization. This flaw has a severity score of 9.1. Attackers can exploit it to access sensitive resources without user interaction. Targets include systems used by banking, government, telecommunications, and logistics sectors. Evidence shows that attackers have already begun actively exploiting these flaws in real-world attacks.
Impact, Security Implications, and Remediation Guidance
The impact of CVE-2026-5430 can be serious. It enables unauthorized file uploads and remote code execution, which can compromise entire systems. CVE-2026-71362 allows attackers to view private customer data by switching user sessions. Resulting breaches can lead to data leaks, system control loss, and further attacks. These vulnerabilities highlight major security risks for organizations using affected products. If your organization uses WSO2 or Adobe Commerce, it is very important to apply patches. However, as of now, specific remediation steps are not detailed in the provided content. Organizations are advised to refer to vendor advisories for patches and instructions. It is crucial to address these vulnerabilities quickly. Federal Civilian Executive Branch (FCEB) agencies, in particular, should implement fixes by September 27, 2026, to reduce the risk of exploitation.
Expand Your Tech Knowledge
Learn how the Internet of Things (IoT) is transforming everyday life.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
