# CISA Adds Actively Exploited WSO2 API Manager and Adobe Commerce Flaws to KEV Catalog, Warns on SharePoint Code Injection

> CISA added a maximum-severity WSO2 API Manager JWT authentication-bypass flaw (CVE-2026-5430, CVSS 10.0) and a critical Adobe Commerce/Magento incorrect-authorization flaw (CVE-2026-71362, CVSS 9.1) to its Known Exploited Vulnerabilities catalog on September 24, 2026, then added a high-severity SharePoint code-injection flaw (CVE-2026-65660, CVSS 8.8) and a medium-severity MikroTik RouterOS pre-authentication SSH bypass (CVE-2026-67279, CVSS 6.5-6.9) on September 25, 2026, all with confirmed active exploitation. Federal civilian agencies face remediation deadlines of September 27-28, 2026.

- **Published:** 2026-09-25T00:00:00Z
- **Last reviewed:** 2026-09-28T01:32:48.782Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2680
- **ID:** TL-2026-2680
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-5430, CVE-2026-71362, CVE-2026-65660, CVE-2026-67279, CVE-2026-67276, CVE-2026-86060

## Description

On September 24-25, 2026, CISA added four unrelated but simultaneously disclosed vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after confirming active in-the-wild exploitation of each. CVE-2026-5430 is a CWE-347 improper cryptographic signature verification flaw in WSO2 API Manager (4.1.0-4.6.0), API Control Plane, Traffic Manager, and Universal Gateway (4.5.0-4.6.0): the JWT validation logic silently accepts tokens signed with an algorithm the server does not support, letting an attacker submit a self-signed JWT carrying a 'sub':'admin' claim and full API-management scope to fully bypass authentication and reach the admin console. WSO2 disclosed the flaw and patches on May 3, 2026 (advisory WSO2-2026-5328, credited to Hacktron Team), but watchTowr's honeypot network first captured forged admin JWTs targeting the vulnerability on September 13, 2026 -- more than four months after patches shipped -- giving attackers the ability to extract every registered application's consumer keys/secrets and pivot into backend API services. CVE-2026-71362 is a CWE-863 incorrect-authorization flaw in Adobe Commerce and Magento Open Source (2.4.4-2.4.9 and B2B 1.5.3, all before the -2026-jul build) where the platform fails to correctly bind customer identity to an account session, letting an unauthenticated, unprivileged, no-interaction attacker switch an active storefront session to a different customer's account and seize their private data. Adobe patched it in APSB26-92 on August 11, 2026; Sansec detected and blocked live exploitation attempts against its Shield WAF customers beginning in August 2026, including a probe from an Australia-based IP on September 10, 2026. CVE-2026-65660 is a CWE-94 code-injection flaw in Microsoft SharePoint Server 2016/2019/Subscription Edition, patched August 11, 2026: the ToolPane.aspx handler fails to escape double quotes inside web-part attribute values when reconstructing 'Register' directives, letting an authenticated attacker inject additional Register directives after the SafeControls safelist check but before the target control loads, registering arbitrary .NET classes and calling XamlServices.Parse() to trigger deserialization-based code execution and drop an in-memory webshell; threat-intel reporting describes this being chained with a separate anonymous ToolPane-access weakness to reach pre-authentication RCE, and the Canadian Centre for Cyber Security confirmed active exploitation in an advisory on September 24, 2026. CVE-2026-67279 is a CWE-841 improper-workflow-enforcement flaw in MikroTik RouterOS: the SSH daemon re-enters the connection protocol after a client-requested rekey without ever completing user authentication, letting an unauthenticated client open a session channel and issue an exec request that the server honors, enabling creation, overwrite, and reconstruction of files (including diagnostic/support output) in the RouterOS managed file namespace. This is one link in the publicly documented 'MikroTrick' exploitation chain alongside CVE-2026-67276 (SSH public-key auth bypass via an RSA key with exponent e=1), CVE-2026-86060 (privilege escalation via a malformed leading-dash SSH username that causes RouterOS to apply full administrator policy), and related flaws CVE-2026-67277/67278/67281, which together give an unauthenticated network attacker root-equivalent control of an Internet-exposed router; MikroTik shipped fixes (6.49.21, 7.23.4, 7.24.2) on September 3, 2026, but a single 24-hour scan on September 5, 2026 still found roughly 122,500 RouterOS devices with SSH reachable from the public Internet, and exploitation had already begun by September 2, 2026. None of the four vulnerabilities have named threat-actor or nation-state attribution in current public reporting; all are opportunistic, internet-scanning-driven exploitation against unpatched edge/management infrastructure.

## MITRE ATT&CK

- T1595 Active Scanning
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1078 Valid Accounts
- T1027 Obfuscated Files or Information
- T1620 Reflective Code Loading
- T1606 Forge Web Credentials
- T1528 Steal Application Access Token
- T1539 Steal Web Session Cookie
- T1565 Data Manipulation
- T1588.005 Obtain Capability
- T1588.006 Obtain Capability
- T1552 Unsecured Credentials
- T1212 Exploitation for Credential Access
- T1550.001 Use Alternate Authentication Material
- T1550.004 Use Alternate Authentication Material

## Sources

- [CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks](https://www.bleepingcomputer.com/news/security/cisa-warns-of-sharepoint-wso2-adobe-commerce-flaws-exploited-in-attacks/)
- [CISA Adds Two Known Exploited Vulnerabilities to Catalog (WSO2, Adobe Commerce)](https://www.cisa.gov/news-events/alerts/2026/09/24/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [CISA Adds Two Known Exploited Vulnerabilities to Catalog (SharePoint, RouterOS)](https://www.cisa.gov/news-events/alerts/2026/09/25/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [CISA KEV Catalog entry - CVE-2026-5430](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-5430)
- [CISA KEV Catalog entry - CVE-2026-71362](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-71362)
- [WSO2 Security Advisory WSO2-2026-5328 (CVE-2026-5430)](https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/)
- [Adobe Security Bulletin APSB26-92 (CVE-2026-71362)](https://helpx.adobe.com/security/products/magento/apsb26-92.html)
- [Microsoft Security Response Center Update Guide - CVE-2026-65660](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-65660)
- [NVD - CVE-2026-5430](https://nvd.nist.gov/vuln/detail/CVE-2026-5430)
- [NVD - CVE-2026-71362](https://nvd.nist.gov/vuln/detail/CVE-2026-71362)
- [NVD - CVE-2026-65660](https://nvd.nist.gov/vuln/detail/CVE-2026-65660)
- [NVD - CVE-2026-67279](https://nvd.nist.gov/vuln/detail/CVE-2026-67279)
- [Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens](https://thehackernews.com/2026/09/active-exploitation-attempts-target.html)
- [Hackers exploit critical Adobe Commerce flaw to hijack customer accounts](https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-adobe-commerce-flaw-to-hijack-customer-accounts/)
- [SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE](https://thehackernews.com/2026/09/sharepoint-flaw-initially-listed-as.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2680