CISA Adds Actively Exploited WSO2 API Manager and Adobe Commerce Flaws to KEV Catalog, Warns on SharePoint Code Injection

CISA Adds Actively Exploited WSO2 API Manager and Adobe (TL-2026-2680) is a critical-severity software vulnerability scored CVSS 10, first published 2026-09-25. It has no confirmed attribution, affects WSO2 API Manager, references 4 CVEs (CVE-2026-5430, CVE-2026-71362, CVE-2026-65660), maps to 12 MITRE ATT&CK techniques (T1027, T1059, T1078), and is covered by 9 detection rules and 10 indicators of compromise.

Key facts for TL-2026-2680

Threat ID
TL-2026-2680
Severity
CRITICAL
CVSS
10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-09-25
Last reviewed
2026-09-25
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, banking, finance, telecoms, logistics, retail, ecommerce, technology
Target regions
Global, North America, australia
Detection rules
9
Indicators of compromise
10

Malware and tooling in CISA Adds Actively Exploited WSO2 API Manager and Adobe

Malware and tooling: Sansec Shield, watchTowr honeypot network

CISA added a maximum-severity WSO2 API Manager JWT authentication-bypass flaw (CVE-2026-5430, CVSS 10.0) and a critical Adobe Commerce/Magento incorrect-authorization flaw (CVE-2026-71362, CVSS 9.1) to its Known Exploited Vulnerabilities catalog on September 24, 2026, then added a high-severity SharePoint code-injection flaw (CVE-2026-65660, CVSS 8.8) and a medium-severity MikroTik RouterOS pre-authentication SSH bypass (CVE-2026-67279, CVSS 6.5-6.9) on September 25, 2026, all with confirmed active exploitation. Federal civilian agencies face remediation deadlines of September 27-28, 2026.

How CISA Adds Actively Exploited WSO2 API Manager and Adobe works

On September 24-25, 2026, CISA added four unrelated but simultaneously disclosed vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after confirming active in-the-wild exploitation of each. CVE-2026-5430 is a CWE-347 improper cryptographic signature verification flaw in WSO2 API Manager (4.1.0-4.6.0), API Control Plane, Traffic Manager, and Universal Gateway (4.5.0-4.6.0): the JWT validation logic silently accepts tokens signed with an algorithm the server does not support, letting an attacker submit a self-signed JWT carrying a 'sub':'admin' claim and full API-management scope to fully bypass authentication and reach the admin console. WSO2 disclosed the flaw and patches on May 3, 2026 (advisory WSO2-2026-5328, credited to Hacktron Team), but watchTowr's honeypot network first captured forged admin JWTs targeting the vulnerability on September 13, 2026 -- more than four months after patches shipped -- giving attackers the ability to extract every registered application's consumer keys/secrets and pivot into backend API services. CVE-2026-71362 is a CWE-863 incorrect-authorization flaw in Adobe Commerce and Magento Open Source (2.4.4-2.4.9 and B2B 1.5.3, all before the -2026-jul build) where the platform fails to correctly bind customer identity to an account session, letting an unauthenticated, unprivileged, no-interaction attacker switch an active storefront session to a different customer's account and seize their private data. Adobe patched it in APSB26-92 on August 11, 2026; Sansec detected and blocked live exploitation attempts against its Shield WAF customers beginning in August 2026, including a probe from an Australia-based IP on September 10, 2026. CVE-2026-65660 is a CWE-94 code-injection flaw in Microsoft SharePoint Server 2016/2019/Subscription Edition, patched August 11, 2026: the ToolPane.aspx handler fails to escape double quotes inside web-part attribute values when reconstructing 'Register' directives, letting an authenticated attacker inject additional Register directives after the SafeControls safelist check but before the target control loads, registering arbitrary .NET classes and calling XamlServices.Parse() to trigger deserialization-based code execution and drop an in-memory webshell; threat-intel reporting describes this being chained with a separate anonymous ToolPane-access weakness to reach pre-authentication RCE, and the Canadian Centre for Cyber Security confirmed active exploitation in an advisory on September 24, 2026. CVE-2026-67279 is a CWE-841 improper-workflow-enforcement flaw in MikroTik RouterOS: the SSH daemon re-enters the connection protocol after a client-requested rekey without ever completing user authentication, letting an unauthenticated client open a session channel and issue an exec request that the server honors, enabling creation, overwrite, and reconstruction of files (including diagnostic/support output) in the RouterOS managed file namespace. This is one link in the publicly documented 'MikroTrick' exploitation chain alongside CVE-2026-67276 (SSH public-key auth bypass via an RSA key with exponent e=1), CVE-2026-86060 (privilege escalation via a malformed leading-dash SSH username that causes RouterOS to apply full administrator policy), and related flaws CVE-2026-67277/67278/67281, which together give an unauthenticated network attacker root-equivalent control of an Internet-exposed router; MikroTik shipped fixes (6.49.21, 7.23.4, 7.24.2) on September 3, 2026, but a single 24-hour scan on September 5, 2026 still found roughly 122,500 RouterOS devices with SSH reachable from the public Internet, and exploitation had already begun by September 2, 2026. None of the four vulnerabilities have named threat-actor or nation-state attribution in current public reporting; all are opportunistic, internet-scanning-driven exploitation against unpatched edge/management infrastructure.

MITRE ATT&CK techniques used in TL-2026-2680

Defense Evasion

T1027 Obfuscated Files or Information; T1620 Reflective Code Loading

Execution

T1059 Command and Scripting Interpreter

Privilege Escalation

T1078 Valid Accounts

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Persistence

T1505 Server Software Component

Credential Access

T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1606 Forge Web Credentials

Impact

T1565 Data Manipulation

Reconnaissance

T1595 Active Scanning

Affected products and versions in CISA Adds Actively Exploited WSO2 API Manager and Adobe

  • WSO2 — API Manager
    Vulnerable versions: 4.1.0; 4.2.0; 4.3.0; 4.4.0; 4.5.0; 4.6.0
    Fixed in: 4.6.0 Update 21; 4.5.0 Update 58; 4.1.0 Update 257 (or per-version minimum update level in WSO2-2026-5328)
  • WSO2 — API Control Plane
    Vulnerable versions: 4.5.0; 4.6.0
    Fixed in: 4.6.0 Update 22; 4.5.0 Update 58
  • WSO2 — Traffic Manager
    Vulnerable versions: 4.5.0; 4.6.0
    Fixed in: 4.6.0 Update 21; 4.5.0 Update 56
  • WSO2 — Universal Gateway
    Vulnerable versions: 4.5.0; 4.6.0
    Fixed in: 4.6.0 Update 21; 4.5.0 Update 57
  • Adobe — Adobe Commerce / Magento Open Source
    Vulnerable versions: 2.4.4-2026-jul and earlier; 2.4.5-2026-jul and earlier; 2.4.6-2026-jul and earlier; 2.4.7-2026-jul and earlier; 2.4.8-2026-jul and earlier; 2.4.9-2026-jul and earlier; Adobe Commerce B2B 1.5.3-2026-jul and earlier
    Fixed in: APSB26-92 isolated patch applied to 2.4.4-2.4.9 lines and B2B 1.5.3
  • Microsoft — SharePoint Server
    Vulnerable versions: Enterprise Server 2016 < 16.0.5565.1001; Server 2019 < 16.0.10417.20198; Subscription Edition < 16.0.19725.20522
    Fixed in: August 11, 2026 security update
  • MikroTik — RouterOS
    Vulnerable versions: 6.x branch prior to 6.49.21; 7.x branch prior to 7.23.4 / 7.24.2
    Fixed in: 6.49.21 (Long-term); 7.23.4 (Long-term); 7.24.2 (Stable)

Remediation for CISA Adds Actively Exploited WSO2 API Manager and Adobe

Patches

  • WSO2-2026-5328 (CVE-2026-5430) - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/
  • Adobe APSB26-92 (CVE-2026-71362) - https://helpx.adobe.com/security/products/magento/apsb26-92.html
  • Microsoft August 11, 2026 security update (CVE-2026-65660) - https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-65660
  • MikroTik RouterOS 6.49.21 / 7.23.4 / 7.24.2 (CVE-2026-67279 and MikroTrick chain)

Immediate actions

  • Apply WSO2 patches per advisory WSO2-2026-5328 to API Manager 4.1.0-4.6.0, API Control Plane, Traffic Manager, and Universal Gateway 4.5.0-4.6.0
  • Apply Adobe Commerce/Magento Open Source patch APSB26-92 (upgrade to the 2.4.9-2026-jul line or later, including B2B 1.5.3)
  • Apply the August 11, 2026 SharePoint Server security update addressing CVE-2026-65660 on SharePoint 2016, 2019, and Subscription Edition
  • Upgrade MikroTik RouterOS to 6.49.21 (Long-term), 7.23.4 (Long-term), or 7.24.2 (Stable) to close CVE-2026-67279 and the related MikroTrick chain (CVE-2026-67276/67277/67278/86060/67281)

Workarounds

  • If patching WSO2 is delayed, enforce strict JWT algorithm allow-listing at the API gateway/reverse proxy to reject tokens signed with unsupported algorithms
  • Disable anonymous or low-privilege access to SharePoint ToolPane-related endpoints until patched
  • Restrict RouterOS SSH service reachability to management VLANs or an explicit IP allow-list and disable password/key-exchange rekeying where not required

Longer-term hardening

  • Rotate all WSO2 API Manager consumer keys, client secrets, and administrator credentials issued prior to patching, since forged-JWT access could have harvested them
  • Audit Adobe Commerce/Magento order and session logs for anomalous cross-account session switches predating the patch
  • Restrict and monitor access to SharePoint /_layouts/15/ToolPane.aspx and alert on XamlServices.Parse()-style deserialization activity or unexpected SafeControls registrations
  • Remove public-Internet SSH exposure on RouterOS devices; treat any device that was Internet-reachable on SSH before September 3, 2026 as potentially compromised and inspect for unauthorized keys and the rogue 'ops' account

CVEs associated with CISA Adds Actively Exploited WSO2 API Manager and Adobe

CVE-2026-5430, CVE-2026-71362, CVE-2026-65660, CVE-2026-67279

Weaknesses (CWE) in CISA Adds Actively Exploited WSO2 API Manager and Adobe

CWE-347, CWE-863, CWE-94, CWE-841

Timeline of CISA Adds Actively Exploited WSO2 API Manager and Adobe

  • WSO2 publishes advisory WSO2-2026-5328 disclosing CVE-2026-5430 (JWT authentication bypass) with patches for API Manager, API Control Plane, Traffic Manager, and Universal Gateway, credited to Hacktron Team.
  • CVE-2026-5430 is published in the NVD with a CVSS 3.1 base score of 10.0.
  • Microsoft's August security update patches CVE-2026-65660, a code-injection flaw in SharePoint Server 2016, 2019, and Subscription Edition.
  • Adobe releases security bulletin APSB26-92 patching CVE-2026-71362 in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source.
  • Exploitation of the MikroTik RouterOS SSH vulnerability chain (including CVE-2026-67279) begins in the wild, per MikroTrick chain research.
  • MikroTik ships fixed RouterOS builds 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable) addressing the MikroTrick SSH vulnerability chain.
  • A single 24-hour Internet scan identifies approximately 122,500 MikroTik RouterOS devices with SSH reachable from the public Internet, still vulnerable to CVE-2026-67279 days after patches shipped; CVE-2026-67279 is published in the NVD the same day.
  • An Australia-based IP address attempts to exploit CVE-2026-71362 against Adobe Commerce honeypot sensors, per threat-intel telemetry.
  • watchTowr's honeypot network first captures forged administrator JWT tokens targeting CVE-2026-5430 in WSO2 API Manager, more than four months after the patch shipped.
  • The Canadian Centre for Cyber Security publishes advisory AL26-023 confirming active exploitation of CVE-2026-65660 in Microsoft SharePoint Server.
  • CISA adds CVE-2026-5430 (WSO2) and CVE-2026-71362 (Adobe Commerce) to the Known Exploited Vulnerabilities catalog, setting a September 27, 2026 federal remediation deadline.
  • BleepingComputer publishes a roundup covering all four CISA KEV additions and the September 27-28 federal remediation deadlines.
  • CISA adds CVE-2026-65660 (SharePoint) and CVE-2026-67279 (MikroTik RouterOS) to the Known Exploited Vulnerabilities catalog, setting a September 28, 2026 federal remediation deadline.

Sources cited for CISA Adds Actively Exploited WSO2 API Manager and Adobe

More in vulnerability

Detection coverage for TL-2026-2680

As of 2026-09-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2680 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats