CISA KEV Additions (2026-09-24): WSO2 JWT Authentication Bypass (CVE-2026-5430, CVSS 10.0) and Adobe Commerce/Magento Incorrect Authorization (CVE-2026-71362, CVSS 9.1) Actively Exploited

CISA KEV Additions (2026-09-24) (TL-2026-2640), also tracked as WSO2 Multiple Products Path Traversal Vulnerability (KEV short name, actual mechanism is JWT auth bypass), is a critical-severity software vulnerability scored CVSS 10, first published 2026-09-24. It has no confirmed attribution, affects WSO2 API Manager, references 2 CVEs (CVE-2026-5430, CVE-2026-71362), maps to 10 MITRE ATT&CK techniques (T1005, T1078, T1098), and is covered by 9 detection rules and 2 indicators of compromise.

Key facts for TL-2026-2640

Threat ID
TL-2026-2640
Also known as
WSO2 Multiple Products Path Traversal Vulnerability (KEV short name, actual mechanism is JWT auth bypass), Adobe Commerce and Magento Incorrect Authorization Vulnerability
Severity
CRITICAL
CVSS
10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-09-24
Last reviewed
2026-09-24
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, finance, retail, ecommerce, technology, telecoms, health
Target regions
North America, Europe, Global
Detection rules
9
Indicators of compromise
2

On 2026-09-24 CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, with BOD 26-04 remediation due 2026-09-27. CVE-2026-5430 is a maximum-severity (CVSS 10.0) JWT authentication bypass in WSO2 API Manager, API Control Plane, Traffic Manager, and Universal Gateway: the products validate tokens signed with unsupported algorithms, letting an attacker forge a JWT carrying baked-in administrator privileges for full admin account takeover. CVE-2026-71362 is a CVSS 9.1 incorrect-authorization flaw (CWE-863) in Adobe Commerce, Commerce B2B, and Magento Open Source permitting unauthenticated customer-account takeover via a customer-session identity switch, exploited within hours of the 2026-08-11 disclosure. Both are unauthenticated, internet-facing, and actively exploited.

How CISA KEV Additions (2026-09-24) works

On 2026-09-24 CISA added two Known Exploited Vulnerabilities to its KEV catalog based on evidence of active exploitation, with required remediation per Binding Operational Directive 26-04 due 2026-09-27. CISA describes both as frequent attack vectors posing significant risk to the federal enterprise. The two flaws affect distinct, widely deployed internet-facing product families.

CVE-2026-5430 - WSO2 JWT Authentication Bypass (CVSS 10.0). The KEV catalog labels this 'WSO2 Multiple Products Path Traversal Vulnerability' (short-name boilerplate that conflates the older WSO2 path-traversal RCE), but the authoritative NVD record and the WSO2 vendor advisory WSO2-2026-5328 describe the actual mechanism as a JWT authentication bypass: 'the JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported.' This is an improper verification of a cryptographic signature (CWE-347). An attacker crafts a JWT with an unsupported algorithm that is nonetheless validated, so a forged token carrying baked-in administrator (Internal/admin-scoped) privileges is accepted, achieving unauthenticated authentication bypass and full account takeover. NVD base score is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0 CRITICAL, adjusted to 9.8 in single-tenant deployments where impact stays within one security authority boundary. Affected products: WSO2 API Manager 4.1.0-4.6.0 (update levels 4.1.0.257 through 4.6.0.21), API Control Plane 4.5.0/4.6.0 (UL 58/22), Traffic Manager 4.5.0/4.6.0 (UL 56/21), Universal Gateway 4.5.0/4.6.0 (UL 57/21), and the Carbon API Manager REST API utility (org.wso2.carbon.apimgt.rest.api.util). WSO2 published advisory WSO2-2026-5328 and security updates on 2026-05-03 (reportedly fixed in April 2026); open-source fixes are in wso2/carbon-apimgt PR 13752 and wso2/product-apim PR 14167; the flaw was reported by the Hacktron Team. The CVE record became public in early August 2026 (NVD published 2026-08-06). Because the WSO2 API gateway sits inline between users, applications, and backend services, a successful bypass exposes API configurations, backend endpoints, application credentials, consumer keys, and authentication secrets for registered applications - effectively full compromise of the API management plane and 'lateral movement as a service' through the gateway. First in-the-wild exploitation was captured by watchTowr's honeypot network on 2026-09-13, when a forged JWT carrying administrator privileges was sent to a honeypot; researchers replayed the forged token against a vulnerable deployment and successfully bypassed authentication, and exploitation attempts using the same approach were observed in the wild. watchTowr disclosed this publicly on 2026-09-16; Field Effect published analysis on 2026-09-17. Exploitation emerged roughly five months after patching, consistent with a threat actor reverse-engineering the vendor's patch diff. CISA SSVC rates exploitation 'active', automatable 'yes', technical impact 'total'.

CVE-2026-71362 - Adobe Commerce and Magento Incorrect Authorization (CVSS 9.1). This is an unauthenticated customer-account-takeover vulnerability caused by incorrect authorization (CWE-863) in how Adobe Commerce and Magento Open Source handle customer identity within an account session. Per Sansec's patch analysis and SecurityOnline's root-cause write-up: an attacker first submits a failed account edit that stores their raw input; that stored data is later copied back into the session without filtering, so an attacker-supplied 'id' value overwrites the session's real customer ID. The session check only confirms the customer record exists - it never verifies ownership, a password, or a token - so the attacker's session simply becomes the victim's. No victim credentials or interaction are required: self-registration is open by default on most stores, so an attacker registers a throwaway account (a guest-allowed action) to stage the switch. Impact is full shopper account takeover - reading personal data, order history, addresses, and stored payment tokens. CVSS is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N = 9.1 CRITICAL. Affected: Adobe Commerce 2.4.4-2.4.9 through the 2026-jul / 2026-aug patch levels, Commerce B2B 1.3.3-1.5.3, and Magento Open Source 2.4.6-2.4.9, all fixed in the 2026-aug releases via Adobe bulletin APSB26-92 (published 2026-08-11), which shipped as isolated patch files (no new Composer packages) and also fixed five other critical flaws including stored XSS. Sansec reported attackers began exploiting within hours of the disclosure and that its Shield product blocked live exploitation attempts; SecurityOnline published a root-cause analysis on 2026-08-28; the Centre for Cybersecurity Belgium (CCB) issued an active-exploitation warning urging immediate patching; CISA later confirmed active exploitation, leading to the KEV listing. CISA SSVC rates exploitation 'active', automatable 'yes', technical impact 'total'.

Both vulnerabilities are unauthenticated, internet-exposed, and actively exploited, making them a priority for immediate patching and BOD 26-04 compliance, pre-patch-compromise forensics triage, and detection of forged JWT tokens (CVE-2026-5430) and anomalous customer-session switches / mass-assigned customer 'id' parameters (CVE-2026-71362).

MITRE ATT&CK techniques used in TL-2026-2640

Collection

T1005 Data from Local System

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application

Defense Evasion

T1078 Valid Accounts

Persistence

T1098 Account Manipulation

Credential Access

T1539 Steal Web Session Cookie; T1552 Unsecured Credentials

lateral-movement

T1550 Use Alternate Authentication Material; T1550.001 Use Alternate Authentication Material: Application Access Token; T1550.004 Use Alternate Authentication Material: Web Session Cookie

Lateral Movement

T1550 Use Alternate Authentication Material

Affected products and versions in CISA KEV Additions (2026-09-24)

  • WSO2 — API Manager
    Vulnerable versions: 4.1.0; 4.2.0; 4.3.0; 4.4.0; 4.5.0; 4.6.0
    Fixed in: 4.1.0.257+; 4.2.0.197+; 4.3.0.108+; 4.4.0.72+; 4.5.0.57+; 4.6.0.21+
  • WSO2 — API Control Plane
    Vulnerable versions: 4.5.0; 4.6.0
    Fixed in: 4.5.0.58+; 4.6.0.22+
  • WSO2 — Traffic Manager
    Vulnerable versions: 4.5.0; 4.6.0
    Fixed in: 4.5.0.56+; 4.6.0.21+
  • WSO2 — Universal Gateway
    Vulnerable versions: 4.5.0; 4.6.0
    Fixed in: 4.5.0.57+; 4.6.0.21+
  • WSO2 — Carbon API Manager REST API Utility (org.wso2.carbon.apimgt.rest.api.util)
    Vulnerable versions: 9.20.74 < 9.20.74.401; 9.28.116 < 9.28.116.417; 9.29.120 < 9.29.120.236; 9.30.67 < 9.30.67.167; 9.31.86 < 9.31.86.158; 9.32.147 < 9.32.147.59
    Fixed in: 9.20.74.401+; 9.28.116.417+; 9.29.120.236+; 9.30.67.167+; 9.31.86.158+; 9.32.147.59+
  • Adobe — Adobe Commerce
    Vulnerable versions: 2.4.4 through 2.4.9 at 2026-jul/2026-aug patch levels
    Fixed in: 2026-aug releases
  • Adobe — Adobe Commerce B2B
    Vulnerable versions: 1.3.3-2026-jul through 1.5.3-2026-jul
    Fixed in: 2026-aug releases
  • Adobe — Magento Open Source
    Vulnerable versions: 2.4.6-2026-jul through 2.4.9-2026-jul
    Fixed in: 2026-aug releases

Remediation for CISA KEV Additions (2026-09-24)

Patches

  • WSO2: open-source fixes in wso2/carbon-apimgt PR 13752 and wso2/product-apim PR 14167; supported updates - API Manager 4.1.0 UL 257 / 4.2.0 UL 197 / 4.3.0 UL 108 / 4.4.0 UL 72 / 4.5.0 UL 57 / 4.6.0 UL 21; API Control Plane 4.5.0 UL 58 / 4.6.0 UL 22; Traffic Manager 4.5.0 UL 56 / 4.6.0 UL 21; Universal Gateway 4.5.0 UL 57 / 4.6.0 UL 21
  • Adobe: APSB26-92 isolated patch for Commerce/Open Source 2.4.4-2.4.9 and B2B 1.3.3-1.5.3; cloud fix in latest cloud-patches update

Immediate actions

  • Apply WSO2 security updates/update levels for API Manager, API Control Plane, Traffic Manager, and Universal Gateway per advisory WSO2-2026-5328 (due 2026-09-27 under BOD 26-04)
  • Apply Adobe APSB26-92 isolated patch (after confirming the latest -p release for the branch) or upgrade Adobe Commerce / Commerce B2B / Magento Open Source to the 2026-aug release
  • Run CISA-mandated pre-patch-compromise forensics triage and audit authentication, administrator-activity, and API-audit logs for indicators of prior compromise

Workarounds

  • WAF rule blocking a mass-assigned 'id' parameter on Magento customer edit and create endpoints (CVE-2026-71362)
  • Monitor and alert on JWT tokens with unexpected/unsupported 'alg' headers or admin-scoped claims reaching WSO2 endpoints (CVE-2026-5430)
  • Discontinue use of vulnerable internet-exposed assets if mitigations are unavailable (per BOD 26-04)

Longer-term hardening

  • Restrict and limit exposure of WSO2 API management, control-plane, traffic-manager, and universal-gateway interfaces to trusted networks only
  • Rotate API keys, consumer keys, application secrets, and service-account credentials that may have been exposed through the WSO2 gateway
  • Deploy EDR/WAF with behavioral detection for forged JWT tokens, unsupported-alg tokens, and mass-assigned customer 'id' parameters

CVEs associated with CISA KEV Additions (2026-09-24)

CVE-2026-5430, CVE-2026-71362

Weaknesses (CWE) in CISA KEV Additions (2026-09-24)

CWE-347, CWE-863

Timeline of CISA KEV Additions (2026-09-24)

  • WSO2 publishes security advisory WSO2-2026-5328 and security updates fixing CVE-2026-5430 (JWT authentication bypass) across API Manager 4.1.0-4.6.0, API Control Plane, Traffic Manager, and Universal Gateway; open-source fixes in carbon-apimgt PR 13752 and product-apim PR 14167; reported by the Hacktron Team
  • CVE-2026-5430 record published in NVD describing improper verification of JWT cryptographic signatures (CWE-347), CVSS 10.0 (adjusted 9.8 in single-tenant)
  • Attackers begin exploiting CVE-2026-71362 within hours of the Adobe disclosure; Sansec Shield blocks live exploitation attempts
  • CVE-2026-71362 published in NVD (incorrect authorization, CWE-863, CVSS 9.1); Sansec publishes account-takeover patch analysis
  • Adobe publishes security bulletin APSB26-92 (isolated patch) fixing CVE-2026-71362 and six other vulnerabilities (five critical, incl. stored XSS) in Adobe Commerce, Commerce B2B, and Magento Open Source
  • Centre for Cybersecurity Belgium (CCB) issues a warning of active exploitation of the critical Adobe Commerce account-takeover vulnerability and urges immediate patching
  • SecurityOnline publishes a root-cause analysis of CVE-2026-71362 describing the customer-session 'id' overwrite / mass-assignment mechanism
  • First observed in-the-wild exploitation of CVE-2026-5430: a forged JWT carrying administrator privileges is sent to watchTowr's research honeypot; replaying it against a vulnerable deployment successfully bypasses authentication
  • watchTowr publicly discloses the active WSO2 exploitation attempts; coverage in SecurityWeek and The Hacker News
  • Field Effect publishes exploitation analysis of the WSO2 authentication bypass, noting exposure of API configs, backend endpoints, consumer keys, and secrets
  • CISA adds both CVE-2026-5430 and CVE-2026-71362 to its Known Exploited Vulnerabilities catalog with BOD 26-04 remediation due 2026-09-27

Sources cited for CISA KEV Additions (2026-09-24)

More in vulnerability

Detection coverage for TL-2026-2640

As of 2026-09-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2640 across Splunk SPL, Microsoft KQL and Sigma, covering 2 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats