# CISA KEV Additions (2026-09-24): WSO2 JWT Authentication Bypass (CVE-2026-5430, CVSS 10.0) and Adobe Commerce/Magento Incorrect Authorization (CVE-2026-71362, CVSS 9.1) Actively Exploited

> On 2026-09-24 CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, with BOD 26-04 remediation due 2026-09-27. CVE-2026-5430 is a maximum-severity (CVSS 10.0) JWT authentication bypass in WSO2 API Manager, API Control Plane, Traffic Manager, and Universal Gateway: the products validate tokens signed with unsupported algorithms, letting an attacker forge a JWT carrying baked-in administrator privileges for full admin account takeover. CVE-2026-71362 is a CVSS 9.1 incorrect-authorization flaw (CWE-863) in Adobe Commerce, Commerce B2B, and Magento Open Source permitting unauthenticated customer-account takeover via a customer-session identity switch, exploited within hours of the 2026-08-11 disclosure. Both are unauthenticated, internet-facing, and actively exploited.

- **Published:** 2026-09-24T00:00:00Z
- **Last reviewed:** 2026-09-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2640
- **ID:** TL-2026-2640
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 2 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-5430, CVE-2026-71362

## Description

On 2026-09-24 CISA added two Known Exploited Vulnerabilities to its KEV catalog based on evidence of active exploitation, with required remediation per Binding Operational Directive 26-04 due 2026-09-27. CISA describes both as frequent attack vectors posing significant risk to the federal enterprise. The two flaws affect distinct, widely deployed internet-facing product families.

CVE-2026-5430 - WSO2 JWT Authentication Bypass (CVSS 10.0). The KEV catalog labels this 'WSO2 Multiple Products Path Traversal Vulnerability' (short-name boilerplate that conflates the older WSO2 path-traversal RCE), but the authoritative NVD record and the WSO2 vendor advisory WSO2-2026-5328 describe the actual mechanism as a JWT authentication bypass: 'the JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported.' This is an improper verification of a cryptographic signature (CWE-347). An attacker crafts a JWT with an unsupported algorithm that is nonetheless validated, so a forged token carrying baked-in administrator (Internal/admin-scoped) privileges is accepted, achieving unauthenticated authentication bypass and full account takeover. NVD base score is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0 CRITICAL, adjusted to 9.8 in single-tenant deployments where impact stays within one security authority boundary. Affected products: WSO2 API Manager 4.1.0-4.6.0 (update levels 4.1.0.257 through 4.6.0.21), API Control Plane 4.5.0/4.6.0 (UL 58/22), Traffic Manager 4.5.0/4.6.0 (UL 56/21), Universal Gateway 4.5.0/4.6.0 (UL 57/21), and the Carbon API Manager REST API utility (org.wso2.carbon.apimgt.rest.api.util). WSO2 published advisory WSO2-2026-5328 and security updates on 2026-05-03 (reportedly fixed in April 2026); open-source fixes are in wso2/carbon-apimgt PR 13752 and wso2/product-apim PR 14167; the flaw was reported by the Hacktron Team. The CVE record became public in early August 2026 (NVD published 2026-08-06). Because the WSO2 API gateway sits inline between users, applications, and backend services, a successful bypass exposes API configurations, backend endpoints, application credentials, consumer keys, and authentication secrets for registered applications - effectively full compromise of the API management plane and 'lateral movement as a service' through the gateway. First in-the-wild exploitation was captured by watchTowr's honeypot network on 2026-09-13, when a forged JWT carrying administrator privileges was sent to a honeypot; researchers replayed the forged token against a vulnerable deployment and successfully bypassed authentication, and exploitation attempts using the same approach were observed in the wild. watchTowr disclosed this publicly on 2026-09-16; Field Effect published analysis on 2026-09-17. Exploitation emerged roughly five months after patching, consistent with a threat actor reverse-engineering the vendor's patch diff. CISA SSVC rates exploitation 'active', automatable 'yes', technical impact 'total'.

CVE-2026-71362 - Adobe Commerce and Magento Incorrect Authorization (CVSS 9.1). This is an unauthenticated customer-account-takeover vulnerability caused by incorrect authorization (CWE-863) in how Adobe Commerce and Magento Open Source handle customer identity within an account session. Per Sansec's patch analysis and SecurityOnline's root-cause write-up: an attacker first submits a failed account edit that stores their raw input; that stored data is later copied back into the session without filtering, so an attacker-supplied 'id' value overwrites the session's real customer ID. The session check only confirms the customer record exists - it never verifies ownership, a password, or a token - so the attacker's session simply becomes the victim's. No victim credentials or interaction are required: self-registration is open by default on most stores, so an attacker registers a throwaway account (a guest-allowed action) to stage the switch. Impact is full shopper account takeover - reading personal data, order history, addresses, and stored payment tokens. CVSS is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N = 9.1 CRITICAL. Affected: Adobe Commerce 2.4.4-2.4.9 through the 2026-jul / 2026-aug patch levels, Commerce B2B 1.3.3-1.5.3, and Magento Open Source 2.4.6-2.4.9, all fixed in the 2026-aug releases via Adobe bulletin APSB26-92 (published 2026-08-11), which shipped as isolated patch files (no new Composer packages) and also fixed five other critical flaws including stored XSS. Sansec reported attackers began exploiting within hours of the disclosure and that its Shield product blocked live exploitation attempts; SecurityOnline published a root-cause analysis on 2026-08-28; the Centre for Cybersecurity Belgium (CCB) issued an active-exploitation warning urging immediate patching; CISA later confirmed active exploitation, leading to the KEV listing. CISA SSVC rates exploitation 'active', automatable 'yes', technical impact 'total'.

Both vulnerabilities are unauthenticated, internet-exposed, and actively exploited, making them a priority for immediate patching and BOD 26-04 compliance, pre-patch-compromise forensics triage, and detection of forged JWT tokens (CVE-2026-5430) and anomalous customer-session switches / mass-assigned customer 'id' parameters (CVE-2026-71362).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1098 Account Manipulation
- T1078 Valid Accounts
- T1550 Use Alternate Authentication Material
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1550.004 Use Alternate Authentication Material: Web Session Cookie
- T1552 Unsecured Credentials
- T1539 Steal Web Session Cookie
- T1005 Data from Local System
- T1550 Use Alternate Authentication Material

## Sources

- [CISA Adds Two Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/09/24/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [CISA KEV Catalog - CVE-2026-5430](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-5430)
- [CISA KEV Catalog - CVE-2026-71362](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-71362)
- [NVD - CVE-2026-5430 (JWT auth bypass, CWE-347, CVSS 10.0)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-5430)
- [NVD - CVE-2026-71362 (Incorrect authorization, CWE-863, CVSS 9.1)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-71362)
- [WSO2 Security Advisory WSO2-2026-5328](https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/)
- [WSO2 carbon-apimgt fix PR 13752](https://github.com/wso2/carbon-apimgt/pull/13752)
- [WSO2 product-apim fix PR 14167](https://github.com/wso2/product-apim/pull/14167)
- [Adobe Security Bulletin APSB26-92](https://helpx.adobe.com/security/products/magento/apsb26-92.html)
- [Sansec - Adobe Commerce Account Takeover APSB26-92](https://sansec.io/research/adobe-commerce-account-takeover-apsb26-92)
- [SecurityOnline - Adobe Commerce CVE-2026-71362 Root Cause](https://securityonline.info/adobe-commerce-vulnerability-cve-2026-71362/)
- [GitHub - cve-2026-71362-magento-lab ROOTCAUSE](https://github.com/dinosn/cve-2026-71362-magento-lab/blob/main/docs/ROOTCAUSE.md)
- [Field Effect - Exploitation of WSO2 Authentication Bypass](https://fieldeffect.com/blog/exploitation-wso2-authentication-bypass)
- [SecurityWeek - Enterprises Warned of Attacks Exploiting WSO2 Vulnerability](https://www.securityweek.com/enterprises-warned-of-attacks-exploiting-wso2-vulnerability/)
- [The Hacker News - Active Exploitation Attempts Target WSO2 API Manager JWT Bypass](https://thehackernews.com/2026/09/active-exploitation-attempts-target.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2640