WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV

CISA has placed two critical vulnerabilities into its Known Exploited Vulnerabilities catalog after confirming they are being actively abused. CVE-2026-5430 (CVSS 9.8) is a path traversal bug in WSO2's API Control Plane, API Manager, Traffic Manager and Universal Gateway that enables unrestricted file upload and remote code execution; watchTowr reported honeypot attacks targeting it since at least September 13, 2026. The second, CVE-2026-71362 (CVSS 9.1), is an authorization flaw in Adobe Commerce and Magento letting attackers hijack another customer's session and steal private account data without any interaction; Sansec blocked exploitation attempts in August, and Previdian logged a probe from an Australian IP on September 10. Federal agencies must apply patches for both issues by September 27, 2026, and other organizations running these platforms are urged to update immediately given confirmed real-world attacks.