CISA Adds Two Exploited Flaws to KEV and Gives Federal Agencies Three Days to Patch

Two additions, one deadline, and a forensic triage requirement

CISA added CVE-2026-5430, which affects several WSO2 products, and CVE-2026-71362, which affects Adobe Commerce and Magento, to its Known Exploited Vulnerabilities Catalog on September 24, 2026.

Both entries cite evidence of active exploitation. Federal Civilian Executive Branch agencies have until September 27, 2026, to remediate — a three-day window that reflects how BOD 26-04 treats flaws under active attack on internet-exposed assets.

The catalog does not attribute either vulnerability to a ransomware operation. Both entries also require forensic triage under BOD 26-04, which sets expectations for checking whether a system was already compromised before administrators apply a patch.

That distinction matters. A KEV listing based on exploitation evidence means the question is no longer whether an attacker will find an exposed instance, but whether one is already inside it. Neither record names a threat actor.

The WSO2 flaw: a path traversal claim and a JWT claim that do not match

The two authoritative descriptions of CVE-2026-5430 describe different bugs, and nothing in the public records reconciles them.

CISA's KEV entry characterizes the issue as a path traversal vulnerability in WSO2 API Control Plane, API Manager, Traffic Manager and Universal Gateway. Under that account, the flaw could permit unrestricted file upload and lead to remote code execution on a vulnerable host.

The NVD record for the same CVE identifier describes a JWT authentication weakness instead. The mechanism accepts tokens signed with algorithms other than those the deployment explicitly configures or supports, and an attacker could craft a token using one of those unsupported algorithms that is then validated anyway. The result is unauthorized access, with the NVD warning that successful exploitation may lead to administrative-account compromise and full account takeover.

Only the path-traversal version appears in the KEV entry. Organizations running the affected WSO2 versions should treat the file-upload and RCE path as the operative risk, while remembering that the authentication weakness described in the NVD record is not addressed by whatever fix closes a path traversal.

Affected WSO2 versions and how the scoring splits

The NVD record supplies the version ranges. Everything below the listed build is affected:

• WSO2 API Control Plane: versions before 4.5.0.58
• WSO2 API Manager: versions before 4.1.0.257
• WSO2 Traffic Manager: versions before 4.5.0.56
• WSO2 Universal Gateway: versions before 4.5.0.57

The NVD assigns CVE-2026-5430 a CVSS v3 score of 10, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H and the weakness classification CWE-347, which covers improper verification of cryptographic signatures — consistent with the JWT description rather than the path traversal one.

The same record states that the score is adjusted to 9.8 in single-tenant deployments, where the impact is contained to one tenant and the scope metric drops from changed to unchanged. That adjusted vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Some reporting on the flaw cites 9.8 without the multi-tenant qualification, which understates the exposure for shared deployments.

Every metric in the unadjusted vector is maximal or near-maximal: network reachable, no privileges required, no user interaction, and high impact across confidentiality, integrity and availability.

Adobe Commerce and Magento: session takeover without user interaction

CVE-2026-71362 is a different class of bug. CISA and the NVD describe it as an incorrect authorization flaw (CWE-863) that could let an attacker obtain elevated access to sensitive resources. Exploitation does not require user interaction, which removes the usual phishing step from the attack chain.

Sansec reported that exploitation could allow an attacker to switch a customer session to another customer's account, exposing that victim's account details and private customer data. That describes account takeover at the session layer rather than a full server compromise, though the business impact on a commerce platform is substantial either way.

The affected version ranges from the NVD are:

• Adobe Commerce: versions before 2.4.4
• Adobe Commerce B2B: versions before 1.3.3
• Adobe Magento: 2.4.6 and earlier

The NVD scores CVE-2026-71362 at CVSS v3 9.1, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Availability is unaffected; confidentiality and integrity are both rated high.

Adobe had not updated its own advisory to confirm exploitation status at the time of the KEV addition. CISA's inclusion rests on separate evidence of active exploitation.

Where the exploitation evidence comes from

For WSO2, watchTowr observed exploitation attempts against its honeypots since at least September 13, 2026. The KEV addition followed a little over a week later. No attacker identity and no specific indicator of compromise were published alongside that observation, so defenders have no network signature to hunt on from this disclosure alone.

For Adobe Commerce and Magento, Sansec said it detected and blocked exploitation attempts in August 2026. Previdian telemetry separately recorded one IP address from Australia attempting to exploit the flaw against its honeypot sensors on September 10, 2026. The address itself was not published, which makes it useless as a blocking rule — the detail establishes that scanning and exploitation activity is geographically distributed, not that a specific host should be filtered.

The gap between observation and catalog listing is the part worth noting. Honeypot hits in August and mid-September preceded the September 24 KEV entry, meaning real deployments may have been exposed for weeks before the deadline clock started.

This is not an isolated cluster in the catalog. CISA has added several other high-severity flaws in the same period: CVE-2026-94127 on September 22 with a September 25 deadline, and CVE-2026-7273 on September 21 with a September 24 deadline. In the past 90 days the catalog has also taken entries affecting WSO2, Adobe and Zyxel, including CVE-2026-75650 on September 8 and CVE-2026-48282 on July 7. Vendors in this group are recurring entries rather than one-off incidents.

What defenders can do now

CISA's required action is to apply mitigations in accordance with vendor instructions, and to do so under BOD 26-04, Prioritizing Security Updates Based on Risk, along with the agency's forensics triage requirements. For cloud deployments, organizations should follow the applicable BOD 26-04 guidance; if mitigations are unavailable, CISA's direction is to discontinue use of the product.

Specific vendor patches, fixed-version numbers and standalone workarounds are not specified in the supplied material. The NVD version ranges give the boundary for each product, but they do not tell an administrator which build to move to.

Two practical points follow from the deadline structure. First, the forensic triage requirement is not optional paperwork — patching a host that an attacker has already accessed through an unsafe JWT validation or a swapped customer session leaves the intrusion in place. Second, assets need an exposure assessment: BOD 26-04 prioritizes rapid remediation where exploitation grants total control over a publicly reachable system, and both of these flaws score high enough to qualify if the instance faces the internet.

Organizations outside the federal civilian executive branch are not bound by the September 27 date, but the KEV listing is the signal CISA intends them to act on. The catalog entry is the finding; the exploitation evidence behind it is the reason to move now rather than at the next patch cycle.