CVE-2026-71362

The Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, warning that they are actively exploited in attacks. These include a critical authentication bypass flaw (CVE-2026-5430) in WSO2 products, an incorrect authorization vulnerability (CVE-2026-71362) in Adobe Commerce and Magento, a high-severity code injection flaw (CVE-2026-65660) in Microsoft SharePoint, and a medium-severity SSH state-machine bypass (CVE-2026-67279) in Mikrotik RouterOS. Security firm watchTowr observed exploitation attempts against WSO2 using forged JWT tokens, and Sansec reported active exploitation of the Adobe Commerce flaw in the wild. Federal agencies are required to patch these flaws by September 27–28, 2026.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation. CVE-2026-5430 is a path traversal flaw in WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway that enables unrestricted file upload and remote code execution. CVE-2026-71362 is an incorrect authorization vulnerability in Adobe Commerce and Magento that allows attackers to escalate privileges and access sensitive customer data without user interaction. Exploitation of both vulnerabilities has been observed in the wild, with attacks detected as early as September 10, 2026.