Threat reportVulnerabilityTL-2026-2680
CISA Adds Actively Exploited WSO2 API Manager and Adobe Commerce Flaws to KEV Catalog, Warns on SharePoint Code Injection
CISA Adds Actively Exploited WSO2 API Manager and Adobe (TL-2026-2680) is a critical-severity software vulnerability scored CVSS 10, first published 2026-09-25 and last reviewed 2026-09-28. It has no confirmed attribution, affects WSO2 API Manager, references 6 CVEs (CVE-2026-5430, CVE-2026-71362, CVE-2026-65660), maps to 18 MITRE ATT&CK techniques (T1027, T1059, T1078), and is covered by 9 detection rules and 12 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 6Referenced vulnerabilities
- Techniques
- 18MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-2680
- Threat ID
- TL-2026-2680
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, banking, finance, telecoms, logistics, retail, ecommerce, technology
- Target regions
- Global, North America, australia
- Detection rules
- 9
- Indicators of compromise
- 12
- Updates
- 2026-09-28 · revalidated 1× · latest source
Malware and tooling in CISA Adds Actively Exploited WSO2 API Manager and Adobe
Malware and tooling: Sansec Shield, watchTowr honeypot network
How CISA Adds Actively Exploited WSO2 API Manager and Adobe works
CISA added a maximum-severity WSO2 API Manager JWT authentication-bypass flaw (CVE-2026-5430, CVSS 10.0) and a critical Adobe Commerce/Magento incorrect-authorization flaw (CVE-2026-71362, CVSS 9.1) to its Known Exploited Vulnerabilities catalog on September 24, 2026, then added a high-severity SharePoint code-injection flaw (CVE-2026-65660, CVSS 8.8) and a medium-severity MikroTik RouterOS pre-authentication SSH bypass (CVE-2026-67279, CVSS 6.5-6.9) on September 25, 2026, all with confirmed active exploitation. Federal civilian agencies face remediation deadlines of September 27-28, 2026.
On September 24-25, 2026, CISA added four unrelated but simultaneously disclosed vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after confirming active in-the-wild exploitation of each. CVE-2026-5430 is a CWE-347 improper cryptographic signature verification flaw in WSO2 API Manager (4.1.0-4.6.0), API Control Plane, Traffic Manager, and Universal Gateway (4.5.0-4.6.0): the JWT validation logic silently accepts tokens signed with an algorithm the server does not support, letting an attacker submit a self-signed JWT carrying a 'sub':'admin' claim and full API-management scope to fully bypass authentication and reach the admin console. WSO2 disclosed the flaw and patches on May 3, 2026 (advisory WSO2-2026-5328, credited to Hacktron Team), but watchTowr's honeypot network first captured forged admin JWTs targeting the vulnerability on September 13, 2026 -- more than four months after patches shipped -- giving attackers the ability to extract every registered application's consumer keys/secrets and pivot into backend API services. CVE-2026-71362 is a CWE-863 incorrect-authorization flaw in Adobe Commerce and Magento Open Source (2.4.4-2.4.9 and B2B 1.5.3, all before the -2026-jul build) where the platform fails to correctly bind customer identity to an account session, letting an unauthenticated, unprivileged, no-interaction attacker switch an active storefront session to a different customer's account and seize their private data. Adobe patched it in APSB26-92 on August 11, 2026; Sansec detected and blocked live exploitation attempts against its Shield WAF customers beginning in August 2026, including a probe from an Australia-based IP on September 10, 2026. CVE-2026-65660 is a CWE-94 code-injection flaw in Microsoft SharePoint Server 2016/2019/Subscription Edition, patched August 11, 2026: the ToolPane.aspx handler fails to escape double quotes inside web-part attribute values when reconstructing 'Register' directives, letting an authenticated attacker inject additional Register directives after the SafeControls safelist check but before the target control loads, registering arbitrary .NET classes and calling XamlServices.Parse() to trigger deserialization-based code execution and drop an in-memory webshell; threat-intel reporting describes this being chained with a separate anonymous ToolPane-access weakness to reach pre-authentication RCE, and the Canadian Centre for Cyber Security confirmed active exploitation in an advisory on September 24, 2026. CVE-2026-67279 is a CWE-841 improper-workflow-enforcement flaw in MikroTik RouterOS: the SSH daemon re-enters the connection protocol after a client-requested rekey without ever completing user authentication, letting an unauthenticated client open a session channel and issue an exec request that the server honors, enabling creation, overwrite, and reconstruction of files (including diagnostic/support output) in the RouterOS managed file namespace. This is one link in the publicly documented 'MikroTrick' exploitation chain alongside CVE-2026-67276 (SSH public-key auth bypass via an RSA key with exponent e=1), CVE-2026-86060 (privilege escalation via a malformed leading-dash SSH username that causes RouterOS to apply full administrator policy), and related flaws CVE-2026-67277/67278/67281, which together give an unauthenticated network attacker root-equivalent control of an Internet-exposed router; MikroTik shipped fixes (6.49.21, 7.23.4, 7.24.2) on September 3, 2026, but a single 24-hour scan on September 5, 2026 still found roughly 122,500 RouterOS devices with SSH reachable from the public Internet, and exploitation had already begun by September 2, 2026. None of the four vulnerabilities have named threat-actor or nation-state attribution in current public reporting; all are opportunistic, internet-scanning-driven exploitation against unpatched edge/management infrastructure.
MITRE ATT&CK techniques used in TL-2026-2680
Defense Evasion
T1027 Obfuscated Files or Information; T1550.001 Use Alternate Authentication Material; T1550.004 Use Alternate Authentication Material; T1620 Reflective Code Loading
Execution
T1059 Command and Scripting Interpreter
Privilege Escalation
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
Credential Access
T1212 Exploitation for Credential Access; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1606 Forge Web Credentials
Persistence
T1505 Server Software Component
Impact
Resource Development
T1588.005 Obtain Capability; T1588.006 Obtain Capability
Reconnaissance
Affected products and versions in CISA Adds Actively Exploited WSO2 API Manager and Adobe
- WSO2 — API Manager
Vulnerable versions: 4.1.0; 4.2.0; 4.3.0; 4.4.0; 4.5.0; 4.6.0
Fixed in: 4.6.0 Update 21; 4.5.0 Update 58; 4.1.0 Update 257 (or per-version minimum update level in WSO2-2026-5328) - WSO2 — API Control Plane
Vulnerable versions: 4.5.0; 4.6.0
Fixed in: 4.6.0 Update 22; 4.5.0 Update 58 - WSO2 — Traffic Manager
Vulnerable versions: 4.5.0; 4.6.0
Fixed in: 4.6.0 Update 21; 4.5.0 Update 56 - WSO2 — Universal Gateway
Vulnerable versions: 4.5.0; 4.6.0
Fixed in: 4.6.0 Update 21; 4.5.0 Update 57 - Adobe — Adobe Commerce / Magento Open Source
Vulnerable versions: 2.4.4-2026-jul and earlier; 2.4.5-2026-jul and earlier; 2.4.6-2026-jul and earlier; 2.4.7-2026-jul and earlier; 2.4.8-2026-jul and earlier; 2.4.9-2026-jul and earlier; Adobe Commerce B2B 1.5.3-2026-jul and earlier
Fixed in: APSB26-92 isolated patch applied to 2.4.4-2.4.9 lines and B2B 1.5.3 - Microsoft — SharePoint Server
Vulnerable versions: Enterprise Server 2016 < 16.0.5565.1001; Server 2019 < 16.0.10417.20198; Subscription Edition < 16.0.19725.20522
Fixed in: August 11, 2026 security update - MikroTik — RouterOS
Vulnerable versions: 6.x branch prior to 6.49.21; 7.x branch prior to 7.23.4 / 7.24.2
Fixed in: 6.49.21 (Long-term); 7.23.4 (Long-term); 7.24.2 (Stable)
Remediation for CISA Adds Actively Exploited WSO2 API Manager and Adobe
Patches
- WSO2-2026-5328 (CVE-2026-5430) - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/
- Adobe APSB26-92 (CVE-2026-71362) - https://helpx.adobe.com/security/products/magento/apsb26-92.html
- Microsoft August 11, 2026 security update (CVE-2026-65660) - https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-65660
- MikroTik RouterOS 6.49.21 / 7.23.4 / 7.24.2 (CVE-2026-67279 and MikroTrick chain)
Immediate actions
- Apply WSO2 patches per advisory WSO2-2026-5328 to API Manager 4.1.0-4.6.0, API Control Plane, Traffic Manager, and Universal Gateway 4.5.0-4.6.0
- Apply Adobe Commerce/Magento Open Source patch APSB26-92 (upgrade to the 2.4.9-2026-jul line or later, including B2B 1.5.3)
- Apply the August 11, 2026 SharePoint Server security update addressing CVE-2026-65660 on SharePoint 2016, 2019, and Subscription Edition
- Upgrade MikroTik RouterOS to 6.49.21 (Long-term), 7.23.4 (Long-term), or 7.24.2 (Stable) to close CVE-2026-67279 and the related MikroTrick chain (CVE-2026-67276/67277/67278/86060/67281)
Workarounds
- If patching WSO2 is delayed, enforce strict JWT algorithm allow-listing at the API gateway/reverse proxy to reject tokens signed with unsupported algorithms
- Disable anonymous or low-privilege access to SharePoint ToolPane-related endpoints until patched
- Restrict RouterOS SSH service reachability to management VLANs or an explicit IP allow-list and disable password/key-exchange rekeying where not required
Longer-term hardening
- Rotate all WSO2 API Manager consumer keys, client secrets, and administrator credentials issued prior to patching, since forged-JWT access could have harvested them
- Audit Adobe Commerce/Magento order and session logs for anomalous cross-account session switches predating the patch
- Restrict and monitor access to SharePoint /_layouts/15/ToolPane.aspx and alert on XamlServices.Parse()-style deserialization activity or unexpected SafeControls registrations
- Remove public-Internet SSH exposure on RouterOS devices; treat any device that was Internet-reachable on SSH before September 3, 2026 as potentially compromised and inspect for unauthorized keys and the rogue 'ops' account
CVEs associated with CISA Adds Actively Exploited WSO2 API Manager and Adobe
CVE-2026-5430, CVE-2026-71362, CVE-2026-65660, CVE-2026-67279, CVE-2026-67276, CVE-2026-86060
Weaknesses (CWE) in CISA Adds Actively Exploited WSO2 API Manager and Adobe
Timeline of CISA Adds Actively Exploited WSO2 API Manager and Adobe
- WSO2 publishes advisory WSO2-2026-5328 disclosing CVE-2026-5430 (JWT authentication bypass) with patches for API Manager, API Control Plane, Traffic Manager, and Universal Gateway, credited to Hacktron Team.
- CVE-2026-5430 is published in the NVD with a CVSS 3.1 base score of 10.0.
- Microsoft's August security update patches CVE-2026-65660, a code-injection flaw in SharePoint Server 2016, 2019, and Subscription Edition.
- Adobe releases security bulletin APSB26-92 patching CVE-2026-71362 in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source.
- Sansec reports it is actively blocking exploitation attempts against CVE-2026-71362 within days of Adobe's APSB26-92 disclosure, despite Adobe stating at release it had no evidence of in-the-wild exploitation.
- Exploitation of the MikroTik RouterOS SSH vulnerability chain (including CVE-2026-67279) begins in the wild, per MikroTrick chain research.
- MikroTik ships fixed RouterOS builds 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable) addressing the MikroTrick SSH vulnerability chain.
- A single 24-hour Internet scan identifies approximately 122,500 MikroTik RouterOS devices with SSH reachable from the public Internet, still vulnerable to CVE-2026-67279 days after patches shipped; CVE-2026-67279 is published in the NVD the same day.
- An Australia-based IP address attempts to exploit CVE-2026-71362 against Adobe Commerce honeypot sensors, per threat-intel telemetry.
- watchTowr's honeypot network first captures forged administrator JWT tokens targeting CVE-2026-5430 in WSO2 API Manager, more than four months after the patch shipped.
- The Canadian Centre for Cyber Security publishes advisory AL26-023 confirming active exploitation of CVE-2026-65660 in Microsoft SharePoint Server.
- CISA adds CVE-2026-5430 (WSO2) and CVE-2026-71362 (Adobe Commerce) to the Known Exploited Vulnerabilities catalog, setting a September 27, 2026 federal remediation deadline.
- BleepingComputer publishes a roundup covering all four CISA KEV additions and the September 27-28 federal remediation deadlines.
- CISA adds CVE-2026-65660 (SharePoint) and CVE-2026-67279 (MikroTik RouterOS) to the Known Exploited Vulnerabilities catalog, setting a September 28, 2026 federal remediation deadline.
Update history for TL-2026-2680
- 2026-09-28 — WSO2 API Manager (CVE-2026-5430) and Adobe Commerce/Magento (CVE-2026-71362) Flaws Added to CISA KEV After Active Exploitation: What changed No severity/exploitability/status escalation needed - CVSS (10.0), exploitability (ACTIVE), and status (ACTIVE) are already at their existing maximum for this bundled record. The report pins a specific 2026-08-13 start date for
Sources cited for CISA Adds Actively Exploited WSO2 API Manager and Adobe
- CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks
- CISA Adds Two Known Exploited Vulnerabilities to Catalog (WSO2, Adobe Commerce)
- CISA Adds Two Known Exploited Vulnerabilities to Catalog (SharePoint, RouterOS)
- CISA KEV Catalog entry - CVE-2026-5430
- CISA KEV Catalog entry - CVE-2026-71362
- WSO2 Security Advisory WSO2-2026-5328 (CVE-2026-5430)
- Adobe Security Bulletin APSB26-92 (CVE-2026-71362)
- Microsoft Security Response Center Update Guide - CVE-2026-65660
- NVD - CVE-2026-5430
- NVD - CVE-2026-71362
- NVD - CVE-2026-65660
- NVD - CVE-2026-67279
- Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens
- Hackers exploit critical Adobe Commerce flaw to hijack customer accounts
- SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE
Detection coverage for TL-2026-2680
As of 2026-09-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2680 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.