CISA Adds Two Actively Exploited Vulnerabilities to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, highlighting security flaws that organizations should treat as active exploitation risks.

The September 24, 2026 update includes CVE-2026-5430, affecting multiple WSO2 products, and CVE-2026-71362, affecting Adobe Commerce and Magento. Both vulnerabilities already have vendor fixes available, making asset identification and remediation particularly important for organizations running affected versions.

The two vulnerabilities affect very different technology environments. WSO2 products are used for API management and related infrastructure, while Adobe Commerce and Magento are used to operate online stores and commerce platforms.

Despite the difference in technology, both vulnerabilities involve security controls that are important to enterprise applications. The WSO2 issue is associated with authentication and token validation, while the Adobe issue involves incorrect authorization.

CISA's decision to place both vulnerabilities in the KEV Catalog provides an additional prioritization signal for security teams.

What Is the CISA KEV Catalog?

The Known Exploited Vulnerabilities Catalog is a list maintained by CISA that tracks vulnerabilities for which there is evidence of exploitation.

The purpose is not simply to provide another list of CVEs. The catalog helps organizations distinguish vulnerabilities that are known to be exploited from the much larger number of vulnerabilities disclosed every year.

For vulnerability-management teams, that distinction can affect remediation priorities.

A vulnerability may have a high CVSS score, for example, but organizations still need to understand whether the affected product is actually deployed, whether it is exposed, and whether exploitation has been observed.

A KEV listing provides another important piece of information: exploitation has been observed or otherwise confirmed sufficiently for inclusion in the catalog.

The September 24 additions show this distinction clearly. Both vulnerabilities were added to the catalog on the same date, and the current KEV records identify September 27, 2026 as the listed due date.

For U.S. federal civilian agencies, CISA's vulnerability-prioritization requirements provide the formal remediation framework. Other organizations are not automatically subject to those federal requirements, but the KEV catalog can still be used as a risk-management input.

The Two Vulnerabilities Added by CISA

The September 24 update covers:

The vulnerabilities differ technically, but both can affect security boundaries that organizations rely on to protect applications and data.

CVE-2026-5430: WSO2 Multiple Products

The first vulnerability is CVE-2026-5430, which affects multiple WSO2 products.

CISA's KEV record identifies the vulnerability as a WSO2 Multiple Products Path Traversal Vulnerability. The affected product families include:

• WSO2 API Control Plane

• WSO2 API Manager

• WSO2 Traffic Manager

• WSO2 Universal Gateway

The WSO2 security advisory provides additional technical information. WSO2 describes CVE-2026-5430 as an authentication bypass vulnerability that can lead to account takeover. The vendor says JWT authentication can be bypassed when a token is signed using an unsupported algorithm, potentially allowing unauthorized access.

WSO2 rates the issue as critical and lists a CVSS score of 10.0 for the affected deployment context described in its advisory. The vendor also notes a CVSS score adjustment to 9.8 for single-tenant deployments because the impact is contained within a single security authority boundary.

This makes the vulnerability particularly relevant to organizations that depend on WSO2 components to control access to APIs and related services.

Why JWT Validation Matters

JSON Web Tokens, commonly called JWTs, are widely used as a way of carrying authentication and authorization information between applications and services.

A simplified authentication flow looks like this:

User or application → Authentication service → JWT issued → API request → JWT validation → Access granted or denied

The validation step is critical.

The receiving system needs to verify that the token is legitimate and that its cryptographic properties meet the expected security requirements.

According to WSO2, CVE-2026-5430 involves a situation where JWT authentication can be bypassed when a token uses an unsupported signing algorithm.

If an authentication control accepts a token that should have been rejected, an attacker may be able to cross a security boundary without having legitimate credentials.

This is why authentication validation vulnerabilities can have consequences beyond a single application endpoint.

WSO2 Products Affected

WSO2 lists the following affected versions in its advisory:

API Control Plane

• 4.6.0

• 4.5.0

API Manager

• 4.6.0

• 4.5.0

• 4.4.0

• 4.3.0

• 4.2.0

• 4.1.0

Traffic Manager

• 4.6.0

• 4.5.0

Universal Gateway

• 4.6.0

• 4.5.0

Organizations should compare these versions against their actual deployment inventory rather than assuming that the presence of WSO2 automatically means the environment is vulnerable.

WSO2 provides product-specific update levels and fixes in its security advisory. It also provides fixes for community users and recommends moving to an unaffected version where applying the fix is not feasible.

CVE-2026-71362: Adobe Commerce and Magento

The second vulnerability is CVE-2026-71362, which affects Adobe Commerce and Magento.

Adobe classifies the issue as an incorrect authorization vulnerability, mapped to CWE-863.

The Adobe security bulletin lists the vulnerability as critical, with a CVSS base score of 9.1. Adobe also states that exploitation does not require authentication or administrator privileges.

CISA's KEV entry describes the vulnerability as an issue that could allow an attacker to gain elevated access to sensitive resources without user interaction.

This is important for organizations operating online stores because authorization controls determine which resources and operations a particular user or request is permitted to access.

Authentication answers a basic question:

"Who are you?"

Authorization addresses a different question:

"What are you allowed to access or do?"

A failure in authorization can therefore create a security problem even when the underlying identity system is working correctly.

Which Adobe Products Are Affected?

Adobe's August 2026 security bulletin covers the affected Commerce and Magento product lines.

The bulletin includes:

• Adobe Commerce

• Adobe Commerce B2B

• Magento Open Source

Adobe's published update information includes multiple supported Commerce and Magento branches and recommends that affected customers update their installations to the latest applicable software.

The vulnerability is particularly relevant to internet-facing commerce infrastructure because these platforms often expose application functionality directly to customers and other external users.

However, organizations should still verify the exact software version, deployment configuration and exposure before determining their individual risk.

Why These KEV Additions Matter

Adding a vulnerability to the KEV Catalog changes the context in which security teams should evaluate it.

Organizations may already have vulnerability scanners that identify CVEs in their environments. However, a large vulnerability backlog can make it difficult to determine which findings require immediate attention.

A KEV listing adds evidence that exploitation is occurring.

That means organizations running affected products should not treat the finding as an ordinary future patching task without first checking whether the affected systems are exposed.

This is especially relevant for internet-facing infrastructure.

A WSO2 API management deployment may sit in front of important application interfaces. An Adobe Commerce deployment may directly support an online storefront.

In both situations, the vulnerable software can occupy an important position within an organization's application architecture.

Active Exploitation Changes the Risk Conversation

A common vulnerability-management workflow might look like this:

Discover → Assess → Prioritize → Patch → Verify

When a vulnerability becomes a known exploited vulnerability, organizations can add another consideration:

Investigate whether exploitation has already occurred.

This does not mean every affected system has been compromised.

It means the organization has a reason to consider that possibility during remediation, particularly when the affected system is externally accessible.

CISA's KEV entries for these vulnerabilities include references to forensics triage requirements, alongside remediation guidance under CISA's risk-based security update directive.

What Security Teams Should Do Now

Organizations using WSO2, Adobe Commerce or Magento should begin with asset identification.

The first question is simple:

Do we have an affected version deployed?

That requires more than searching a software inventory by product name.

Security teams should consider:

• Production systems

• Development and testing environments

• Internet-facing instances

• Cloud-hosted deployments

• API gateways

• Commerce infrastructure

• Systems managed by third-party teams

• Older installations that may not appear in the primary asset inventory

Once affected systems are identified, teams should determine whether the vulnerable components are externally accessible.

An internet-facing system deserves particular attention because an attacker may be able to reach it without first gaining access to an internal network.

1. Verify the Installed Versions

For WSO2 environments, compare deployed versions against WSO2's affected-version list and security update guidance.

For Adobe Commerce and Magento, check the installed version against Adobe's security bulletin and applicable August 2026 security releases.

Do not rely only on the product's major version.

Security fixes can depend on the exact release or update level.

2. Prioritize Internet-Facing Systems

The next step is exposure assessment.

Ask:

• Is the system accessible from the public internet?

• Which ports and services are exposed?

• Is the affected application behind a reverse proxy or security gateway?

• Which APIs are reachable externally?

• Does the system handle authentication or authorization?

• Does it have access to sensitive business data?

This helps security teams understand where remediation should begin.

3. Apply Vendor Security Updates

WSO2 has published specific update levels and fixes for CVE-2026-5430.

Adobe has also published security updates addressing CVE-2026-71362 as part of its Commerce and Magento security bulletin.

Organizations should follow the vendor's official update instructions rather than attempting to create their own modifications to the affected security controls.

If an update cannot immediately be deployed, security teams should follow the vendor's documented mitigations and CISA guidance applicable to their environment.

Patch First, Then Verify

Applying a security update is not necessarily the final step.

After remediation, organizations should verify that:

1. The expected version or update level is installed.

2. The vulnerable component is no longer present in the affected configuration.

3. Internet exposure has not changed unexpectedly.

4. Security monitoring remains active.

5. Relevant authentication and authorization controls are functioning correctly.

This verification step helps prevent situations where a patch was applied to one server while another vulnerable instance remains active.

Large organizations may have multiple environments, regional deployments or redundant application infrastructure.

A centralized vulnerability-management platform can help track remediation status across those systems.

Should Organizations Investigate for Previous Exploitation?

Because both vulnerabilities have been added to CISA's KEV Catalog, organizations should consider whether vulnerable systems may have been targeted before remediation.

The appropriate investigation depends on the organization's environment and available telemetry.

Security teams can review relevant logs for unusual authentication activity, unexpected administrative actions, suspicious API requests and other behavior associated with the affected application.

The investigation should focus on evidence rather than assumptions.

The presence of a vulnerable version does not by itself prove that an organization was compromised.

Likewise, a lack of obvious indicators in a limited log source does not necessarily prove that no malicious activity occurred.

The available evidence, logging coverage and system architecture all affect what an organization can determine.

CISA's KEV records for these vulnerabilities specifically reference its forensics triage guidance.

A Broader Lesson for Vulnerability Management

The September 24 KEV additions illustrate a broader shift in how organizations approach software vulnerabilities.

Modern vulnerability management is no longer only about asking:

"How severe is this CVE?"

Security teams increasingly need to consider several questions together:

Is the affected software actually deployed?

Is it exposed to the internet?

Is exploitation known to be occurring?

What access does the vulnerable system have?

Is a security update available?

Could the system have already been targeted?

This approach can help organizations focus limited security resources on vulnerabilities with the most immediate operational relevance.

For enterprises, the development also highlights the importance of maintaining accurate asset inventories.

A security team cannot effectively patch an unknown system.

If a vulnerable WSO2 gateway exists outside the organization's central inventory, or an old Magento installation remains online without being tracked, conventional patch-management processes may not identify it quickly.

What This Means for WSO2 and Magento Users

For WSO2 users, CVE-2026-5430 deserves attention because the vendor describes an authentication bypass involving JWT validation, while CISA has now included the vulnerability in its known-exploited catalog.

For Adobe Commerce and Magento users, CVE-2026-71362 is an incorrect authorization vulnerability that Adobe rates as critical and that CISA has identified as known exploited.

In both cases, organizations should establish whether they run an affected version, determine whether the system is externally accessible, apply the appropriate vendor update and consider investigation for signs of previous exploitation.

The CISA KEV listing does not mean every organization using these products has been attacked. It does, however, provide a clear reason to move the vulnerabilities higher in the remediation queue.

Final Takeaway

CISA's September 24 update adds CVE-2026-5430 and CVE-2026-71362 to its Known Exploited Vulnerabilities Catalog.

The first affects multiple WSO2 products and is described by WSO2 as an authentication bypass involving JWT validation. The second affects Adobe Commerce and Magento and involves incorrect authorization that can allow elevated access to sensitive resources.

Both vulnerabilities have vendor remediation guidance available.

For organizations running affected products, the immediate priority is to identify vulnerable assets, determine their exposure, apply the relevant security updates and review available security telemetry for possible exploitation.

The larger lesson is straightforward: when a vulnerability moves from a general CVE record into a known-exploited catalog, vulnerability management becomes more closely connected with exposure management, patching and incident investigation.

Additional details about the specific threat actors, attack campaigns or organizations targeted through these vulnerabilities were not disclosed in the available CISA announcement.

Sources

• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog, September 24, 2026

• WSO2: Security Advisory WSO2-2026-5328 / CVE-2026-5430

• Adobe: Security Bulletin APSB26-92 for Adobe Commerce and Magento

• CISA KEV records: CVE-2026-5430 and CVE-2026-71362