CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks

CISA has added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. The most severe, CVE-2026-5430, carries a maximum CVSS score and lets attackers bypass authentication in WSO2 API Manager (versions 4.1.0-4.6.0), API Control Plane, Traffic Manager, and Universal Gateway (4.5.0 and 4.6.0) by exploiting flawed JWT signature validation, potentially granting full admin takeover. Security firm watchTowr confirmed honeypot captures of forged-token attack attempts against WSO2 products starting September 13. A second critical bug, CVE-2026-71362, is an authorization flaw in Adobe Commerce and Magento that Sansec says can be exploited without any account or user interaction, enabling customer account hijacking. CISA also flagged a high-severity code injection issue in Microsoft SharePoint (CVE-2026-65660) and a medium-severity pre-authentication SSH bypass in MikroTik RouterOS (CVE-2026-67279). Federal agencies must remediate the WSO2 and Adobe flaws by September 27, and the SharePoint and RouterOS issues by September 28, though CISA urges all organizations to patch promptly given the broad use of these platforms across banking, government, and telecom sectors.