CISA Adds Actively Exploited WSO2 API Manager and Adobe Commerce Flaws to KEV Catalog, Warns on SharePoint Code Injection

Key facts

Detection coverage

As of 2026-09-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2680 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: WSO2 API Manager Forged Administrator JWT Authentication Bypass (CVE-2026-5430)

Detects a JWT presented to WSO2 API Manager / API Control Plane / Traffic Manager / Universal Gateway admin or management-plane endpoints whose header algorithm is not the server's supported RS256 signer (e.g. none/HS256/null) while the payload carries a 'sub':'admin' claim -- the forged-token pattern first observed by watchTowr's honeypot network on 2026-09-13 exploiting the CWE-347 signature-verification bypass to reach the admin console and harvest every registered application's consumer keys/secrets.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1606, T1078
• Data sources: wso2_apim_access_log, web_proxy, api_gateway_audit_log
• Severity: critical
• Confidence: high

Splunk SPL

index=web sourcetype="wso2:apim:access" (uri_path="/admin/*" OR uri_path="/api/am/admin/*" OR uri_path="/carbon/admin/*" OR uri_path="*/oauth2/introspect*")
| rex field=_raw "Authorization:\s*Bearer\s+(?<jwt>[\w-]+\.[\w-]+\.[\w-]*)"
| where isnotnull(jwt)
| eval jwt_header=mvindex(split(jwt,"."),0), jwt_payload=mvindex(split(jwt,"."),1)
| eval decoded_header=base64decode(jwt_header), decoded_payload=base64decode(jwt_payload)
| where NOT match(decoded_header, "\"alg\"\s*:\s*\"RS256\"") AND match(decoded_payload, "\"sub\"\s*:\s*\"admin\"")
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as src_ips values(uri_path) as targeted_endpoints by host
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| table host, first_seen, last_seen, count, src_ips, targeted_endpoints

Microsoft KQL

let SuspectPaths = dynamic(["/admin", "/api/am/admin", "/carbon/admin", "/oauth2/introspect"]);
Custom_WSO2_CL
| where TimeGenerated > ago(24h)
| where RequestPath_s has_any (SuspectPaths)
| extend JwtSegments = split(trim("Bearer ", AuthorizationHeader_s), ".")
| where array_length(JwtSegments) >= 2
| extend HeaderJson = base64_decode_tostring(tostring(JwtSegments[0])), PayloadJson = base64_decode_tostring(tostring(JwtSegments[1]))
| where HeaderJson !contains "RS256" and PayloadJson contains "\"sub\":\"admin\""
| project TimeGenerated, SrcIpAddr_s, RequestPath_s, HeaderJson, PayloadJson, HostName_s
| summarize count(), make_set(RequestPath_s), make_set(SrcIpAddr_s) by HostName_s, bin(TimeGenerated, 1h)

Sigma

title: WSO2 API Manager Forged Administrator JWT (CVE-2026-5430)
id: 7c1e5a2e-4b9d-4a3f-9b2e-3e1f8a2c6d01
status: experimental
description: Detects a WSO2 API Manager admin/management-plane request bearing a JWT whose algorithm header is not the expected RS256 signer while carrying a 'sub':'admin' claim, consistent with the CVE-2026-5430 signature-verification bypass.
references:
    - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/
    - https://thehackernews.com/2026/09/active-exploitation-attempts-target.html
author: Threadlinqs Team
date: 2026-09-27
tags:
    - attack.initial-access
    - attack.t1190
    - attack.credential-access
    - attack.t1606
    - attack.t1078
    - cve.2026.5430
logsource:
    category: webserver
    product: wso2
detection:
    selection_path:
        cs-uri-stem|contains:
            - '/admin'
            - '/api/am/admin'
            - '/carbon/admin'
            - '/oauth2/introspect'
    selection_auth:
        cs-Authorization|contains: 'Bearer '
    filter_valid_alg:
        cs-Authorization|contains: '.RS256.'
    condition: selection_path and selection_auth and not filter_valid_alg
falsepositives:
    - Custom internal JWT issuers that legitimately sign with a non-RS256 algorithm the gateway has been explicitly configured to trust
level: critical

Known false positives:

• Internal test/CI tooling issuing self-signed JWTs against a non-production WSO2 tenant configured to trust alternate algorithms

Tuning notes: Scope uri_path/RequestPath filters to the tenant's actual admin/management-plane routes; if the org has legitimately whitelisted a non-RS256 algorithm for machine-to-machine auth, add that algorithm to the RS256 allow-check instead of alerting on every non-RS256 token.

• 🔒 Adobe Commerce/Magento Cross-Account Session Switch Exploitation (CVE-2026-71362) · unlock with TL Creds
• 🔒 SharePoint w3wp.exe Deserialization-Triggered Child Process (XamlServices.Parse / CVE-2026-65660) · unlock with TL Creds
• 🔒 WSO2 Admin-Console Pivot to Backend API Consumer-Key Extraction After Forged JWT (CVE-2026-5430) · unlock with TL Creds
• 🔒 MikroTik RouterOS Post-Rekey Unauthenticated SSH Exec Channel (CVE-2026-67279) · unlock with TL Creds
• 🔒 MikroTik RouterOS Leading-Dash SSH Username Privilege Escalation (CVE-2026-86060) · unlock with TL Creds
• 🔒 SharePoint In-Memory Webshell Outbound C2 Beacon from w3wp.exe (Post CVE-2026-65660) · unlock with TL Creds
• 🔒 SharePoint ToolPane.aspx Register-Directive Injection Dropping In-Memory Webshell (CVE-2026-65660) · unlock with TL Creds
• 🔒 MikroTik RouterOS Unauthorized 'ops' Account and SSH Key Persistence Enabling Lateral Pivot (MikroTrick / CVE-2026-67279) · unlock with TL Creds

Indicators of compromise

As of 2026-09-28, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-2680.

Sample indicators (2 of 12)

• IP address: 82.192.72[.]4
• IP address: 103.102.31[.]18

Defanged, TLP:CLEAR. Full set of 12 indicators: unlock with TL Creds.

Technical analysis

Federal civilian agencies face remediation deadlines of September 27-28, 2026.

On September 24-25, 2026, CISA added four unrelated but simultaneously disclosed vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after confirming active in-the-wild exploitation of each. CVE-2026-5430 is a CWE-347 improper cryptographic signature verification flaw in WSO2 API Manager (4.1.0-4.6.0), API Control Plane, Traffic Manager, and Universal Gateway (4.5.0-4.6.0): the JWT validation logic silently accepts tokens signed with an algorithm the server does not support, letting an attacker submit a self-signed JWT carrying a 'sub':'admin' claim and full API-management scope to fully bypass authentication and reach the admin console. WSO2 disclosed the flaw and patches on May 3, 2026 (advisory WSO2-2026-5328, credited to Hacktron Team), but watchTowr's honeypot network first captured forged admin JWTs targeting the vulnerability on September 13, 2026 -- more than four months after patches shipped -- giving attackers the ability to extract every registered application's consumer keys/secrets and pivot into backend API services. CVE-2026-71362 is a CWE-863 incorrect-authorization flaw in Adobe Commerce and Magento Open Source (2.4.4-2.4.9 and B2B 1.5.3, all before the -2026-jul build) where the platform fails to correctly bind customer identity to an account session, letting an unauthenticated, unprivileged, no-interaction attacker switch an active storefront session to a different customer's account and seize their private data. Adobe patched it in APSB26-92 on August 11, 2026; Sansec detected and blocked live exploitation attempts against its Shield WAF customers beginning in August 2026, including a probe from an Australia-based IP on September 10, 2026. CVE-2026-65660 is a CWE-94 code-injection flaw in Microsoft SharePoint Server 2016/2019/Subscription Edition, patched August 11, 2026: the ToolPane.aspx handler fails to escape double quotes inside web-part attribute values when reconstructing 'Register' directives, letting an authenticated attacker inject additional Register directives after the SafeControls safelist check but before the target control loads, registering arbitrary .NET classes and calling XamlServices.Parse() to trigger deserialization-based code execution and drop an in-memory webshell; threat-intel reporting describes this being chained with a separate anonymous ToolPane-access weakness to reach pre-authentication RCE, and the Canadian Centre for Cyber Security confirmed active exploitation in an advisory on September 24, 2026. CVE-2026-67279 is a CWE-841 improper-workflow-enforcement flaw in MikroTik RouterOS: the SSH daemon re-enters the connection protocol after a client-requested rekey without ever completing user authentication, letting an unauthenticated client open a session channel and issue an exec request that the server honors, enabling creation, overwrite, and reconstruction of files (including diagnostic/support output) in the RouterOS managed file namespace. This is one link in the publicly documented 'MikroTrick' exploitation chain alongside CVE-2026-67276 (SSH public-key auth bypass via an RSA key with exponent e=1), CVE-2026-86060 (privilege escalation via a malformed leading-dash SSH username that causes RouterOS to apply full administrator policy), and related flaws CVE-2026-67277/67278/67281, which together give an unauthenticated network attacker root-equivalent control of an Internet-exposed router; MikroTik shipped fixes (6.49.21, 7.23.4, 7.24.2) on September 3, 2026, but a single 24-hour scan on September 5, 2026 still found roughly 122,500 RouterOS devices with SSH reachable from the public Internet, and exploitation had already begun by September 2, 2026. None of the four vulnerabilities have named threat-actor or nation-state attribution in current public reporting; all are opportunistic, internet-scanning-driven exploitation against unpatched edge/management infrastructure.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1550.001 Use Alternate Authentication Material; T1550.004 Use Alternate Authentication Material; T1620 Reflective Code Loading

Execution

T1059 Command and Scripting Interpreter

Privilege Escalation

T1078 Valid Accounts

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Credential Access

T1212 Exploitation for Credential Access; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1606 Forge Web Credentials

Persistence

T1505 Server Software Component

Impact

T1565 Data Manipulation

Resource Development

T1588.005 Obtain Capability; T1588.006 Obtain Capability

Reconnaissance

T1595 Active Scanning

Remediation

Patches

• WSO2-2026-5328 (CVE-2026-5430) - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/
• Adobe APSB26-92 (CVE-2026-71362) - https://helpx.adobe.com/security/products/magento/apsb26-92.html
• Microsoft August 11, 2026 security update (CVE-2026-65660) - https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-65660
• MikroTik RouterOS 6.49.21 / 7.23.4 / 7.24.2 (CVE-2026-67279 and MikroTrick chain)

Immediate actions

• Apply WSO2 patches per advisory WSO2-2026-5328 to API Manager 4.1.0-4.6.0, API Control Plane, Traffic Manager, and Universal Gateway 4.5.0-4.6.0
• Apply Adobe Commerce/Magento Open Source patch APSB26-92 (upgrade to the 2.4.9-2026-jul line or later, including B2B 1.5.3)
• Apply the August 11, 2026 SharePoint Server security update addressing CVE-2026-65660 on SharePoint 2016, 2019, and Subscription Edition
• Upgrade MikroTik RouterOS to 6.49.21 (Long-term), 7.23.4 (Long-term), or 7.24.2 (Stable) to close CVE-2026-67279 and the related MikroTrick chain (CVE-2026-67276/67277/67278/86060/67281)

Workarounds

• If patching WSO2 is delayed, enforce strict JWT algorithm allow-listing at the API gateway/reverse proxy to reject tokens signed with unsupported algorithms
• Disable anonymous or low-privilege access to SharePoint ToolPane-related endpoints until patched
• Restrict RouterOS SSH service reachability to management VLANs or an explicit IP allow-list and disable password/key-exchange rekeying where not required

Longer-term hardening

• Rotate all WSO2 API Manager consumer keys, client secrets, and administrator credentials issued prior to patching, since forged-JWT access could have harvested them
• Audit Adobe Commerce/Magento order and session logs for anomalous cross-account session switches predating the patch
• Restrict and monitor access to SharePoint /_layouts/15/ToolPane.aspx and alert on XamlServices.Parse()-style deserialization activity or unexpected SafeControls registrations
• Remove public-Internet SSH exposure on RouterOS devices; treat any device that was Internet-reachable on SSH before September 3, 2026 as potentially compromised and inspect for unauthorized keys and the rogue 'ops' account

Affected and fixed versions

• WSO2 — API Manager
  Vulnerable versions: 4.1.0; 4.2.0; 4.3.0; 4.4.0; 4.5.0; 4.6.0
  Fixed in: 4.6.0 Update 21; 4.5.0 Update 58; 4.1.0 Update 257 (or per-version minimum update level in WSO2-2026-5328)
• WSO2 — API Control Plane
  Vulnerable versions: 4.5.0; 4.6.0
  Fixed in: 4.6.0 Update 22; 4.5.0 Update 58
• WSO2 — Traffic Manager
  Vulnerable versions: 4.5.0; 4.6.0
  Fixed in: 4.6.0 Update 21; 4.5.0 Update 56
• WSO2 — Universal Gateway
  Vulnerable versions: 4.5.0; 4.6.0
  Fixed in: 4.6.0 Update 21; 4.5.0 Update 57
• Adobe — Adobe Commerce / Magento Open Source
  Vulnerable versions: 2.4.4-2026-jul and earlier; 2.4.5-2026-jul and earlier; 2.4.6-2026-jul and earlier; 2.4.7-2026-jul and earlier; 2.4.8-2026-jul and earlier; 2.4.9-2026-jul and earlier; Adobe Commerce B2B 1.5.3-2026-jul and earlier
  Fixed in: APSB26-92 isolated patch applied to 2.4.4-2.4.9 lines and B2B 1.5.3
• Microsoft — SharePoint Server
  Vulnerable versions: Enterprise Server 2016 < 16.0.5565.1001; Server 2019 < 16.0.10417.20198; Subscription Edition < 16.0.19725.20522
  Fixed in: August 11, 2026 security update
• MikroTik — RouterOS
  Vulnerable versions: 6.x branch prior to 6.49.21; 7.x branch prior to 7.23.4 / 7.24.2
  Fixed in: 6.49.21 (Long-term); 7.23.4 (Long-term); 7.24.2 (Stable)

Timeline

Last updated 2026-09-28 · revalidated 1× · latest source

• 2026-05-03 WSO2 publishes advisory WSO2-2026-5328 disclosing CVE-2026-5430 (JWT authentication bypass) with patches for API Manager, API Control Plane, Traffic Manager, and Universal Gateway, credited to Hacktron Team.
• 2026-08-06 CVE-2026-5430 is published in the NVD with a CVSS 3.1 base score of 10.0.
• 2026-08-11 Microsoft's August security update patches CVE-2026-65660, a code-injection flaw in SharePoint Server 2016, 2019, and Subscription Edition.
• 2026-08-11 Adobe releases security bulletin APSB26-92 patching CVE-2026-71362 in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source.
• 2026-08-13 Sansec reports it is actively blocking exploitation attempts against CVE-2026-71362 within days of Adobe's APSB26-92 disclosure, despite Adobe stating at release it had no evidence of in-the-wild exploitation.
• 2026-09-02 Exploitation of the MikroTik RouterOS SSH vulnerability chain (including CVE-2026-67279) begins in the wild, per MikroTrick chain research.
• 2026-09-03 MikroTik ships fixed RouterOS builds 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable) addressing the MikroTrick SSH vulnerability chain.
• 2026-09-05 A single 24-hour Internet scan identifies approximately 122,500 MikroTik RouterOS devices with SSH reachable from the public Internet, still vulnerable to CVE-2026-67279 days after patches shipped; CVE-2026-67279 is published in the NVD the same day.
• 2026-09-10 An Australia-based IP address attempts to exploit CVE-2026-71362 against Adobe Commerce honeypot sensors, per threat-intel telemetry.
• 2026-09-13 watchTowr's honeypot network first captures forged administrator JWT tokens targeting CVE-2026-5430 in WSO2 API Manager, more than four months after the patch shipped.
• 2026-09-24 The Canadian Centre for Cyber Security publishes advisory AL26-023 confirming active exploitation of CVE-2026-65660 in Microsoft SharePoint Server.
• 2026-09-24 CISA adds CVE-2026-5430 (WSO2) and CVE-2026-71362 (Adobe Commerce) to the Known Exploited Vulnerabilities catalog, setting a September 27, 2026 federal remediation deadline.
• 2026-09-25 BleepingComputer publishes a roundup covering all four CISA KEV additions and the September 27-28 federal remediation deadlines.
• 2026-09-25 CISA adds CVE-2026-65660 (SharePoint) and CVE-2026-67279 (MikroTik RouterOS) to the Known Exploited Vulnerabilities catalog, setting a September 28, 2026 federal remediation deadline.

Update history

• 2026-09-28 — WSO2 API Manager (CVE-2026-5430) and Adobe Commerce/Magento (CVE-2026-71362) Flaws Added to CISA KEV After Active Exploitation: What changed No severity/exploitability/status escalation needed - CVSS (10.0), exploitability (ACTIVE), and status (ACTIVE) are already at their existing maximum for this bundled record.

Sources cited

Showing 15 of 17 sources, primary sources first.

• CISA Adds Two Known Exploited Vulnerabilities to Catalog (WSO2, Adobe Commerce) CISA · Government advisory · 2026-09-24
• CISA Adds Two Known Exploited Vulnerabilities to Catalog (SharePoint, RouterOS) CISA · Government advisory · 2026-09-25
• CISA KEV Catalog entry - CVE-2026-5430 CISA · Government advisory · 2026-09-24
• CISA KEV Catalog entry - CVE-2026-71362 CISA · Government advisory · 2026-09-24
• NVD - CVE-2026-5430 NVD (NIST) · Advisory · 2026-08-06
• NVD - CVE-2026-71362 NVD (NIST) · Advisory · 2026-08-11
• NVD - CVE-2026-65660 NVD (NIST) · Advisory · 2026-08-11
• NVD - CVE-2026-67279 NVD (NIST) · Advisory · 2026-09-05
• AL26-023 - Vulnerability Impacting Microsoft SharePoint Server - CVE-2026-65660 cyber.gc.ca · Advisory · 2026-09-24
• WSO2 Security Advisory WSO2-2026-5328 (CVE-2026-5430) security.docs.wso2.com · Vendor report · 2026-05-03
• Adobe Security Bulletin APSB26-92 (CVE-2026-71362) helpx.adobe.com · Vendor report · 2026-08-11
• Microsoft Security Response Center Update Guide - CVE-2026-65660 Microsoft Security Response Center · Vendor report · 2026-08-11
• MikroTrick: Chained MikroTik RouterOS SSH Bugs Give Unauthenticated Root, 122,500 Devices Exposed cybercrime.club · Research · 2026-09-05
• CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks BleepingComputer · News · 2026-09-25
• Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens The Hacker News · News · 2026-09-16

More in vulnerability

• PostgreSQL CVE-2026-6460: 22-Year-Old Composite Type Confusion Enables Authenticated RCE; 52 CVEs Fixed in 18.7/17.12/16.16/15.20/14.25
• Citrix NetScaler ADC and Gateway: 28 Vulnerabilities Patched (CTX697305), Including Critical CVE-2026-120868 in Default Configurations
• Forescout Vedere Labs: AI-assisted harness finds 66 new vulnerabilities across 10 legacy TCP/IP stacks used in OT/IoT (incl. Nucleus NET CVE-2026-89208, CVE-2026-102073..102076; Ethernut CVE-2026-120596)
• GitHub Security Lab Taskflow Agent identifies 24 Android app vulnerabilities (OsmAnd exported MapActivity location tracking, Wikipedia deeplink account takeover; CVE-2026-65993 to CVE-2026-65997)
• SignDrop – Windows CLFS/Defender Local Privilege Escalation Zero-Day with Public PoC (Nightmare Eclipse)

Other reports on CVE-2026-71362

• Adobe Patches Critical RCE Flaws in ColdFusion, Campaign Classic, and Commerce (CVE-2026-48362, CVSS 10.0)

Previous and next in vulnerability

• Multiple PHP Vulnerabilities Enable Denial of Service, TLS Verification Bypass, and Credential Leakage (CVE-2026-91765, CVE-2026-91768, CVE-2026-6103 and 8 Others) — GovCERT.HK A26-09-40 Previous report
• Microsoft Office / Microsoft 365 Apps for Enterprise Remote Code Execution Vulnerability (CVE-2026-70125) Next report