CISA 2026-09-24

CISA KEV — WSO2 Multiple Products (CVE-2026-5430) +1 more

Machine-generated analysis · WAYSCloud LLM

CISA added CVE-2026-5430 (WSO2 path-traversal) and CVE-2026-71362 (Adobe Commerce/Magento incorrect-authorization) to its KEV Catalog.

Context

The advisory lists CVE-2026-5430, a path-traversal flaw in multiple WSO2 products, and CVE-2026-71362, an incorrect-authorization issue in Adobe Commerce and Magento. Both vulnerabilities are noted as actively exploited and have been added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog. The advisory references BOD 26-04, which directs federal agencies to prioritize rapid remediation of KEV items on publicly exposed assets.

Operator considerations

Check: Verify whether any WSO2 products or Adobe Commerce/Magento installations are present on publicly exposed assets.
Isolate: Limit network exposure of any identified instances until they are patched.
Patch: Apply vendor-released patches or mitigations for CVE-2026-5430 and CVE-2026-71362 as soon as they become available.
Log: Monitor logs for path-traversal attempts on WSO2 services and unauthorized access attempts on Adobe Commerce/Magento.

From Cybersecurity and Infrastructure Security Agency ↗

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability

CVE-2026-71362 Adobe Commerce and Magento Incorrect Authorization Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed asse...

Read the full advisory on CISA →