CISA Flags Two Critical Flaws in WSO2 and Adobe Commerce for Active Exploitation

En bref

• Two critical vulnerabilities affect WSO2 API Control Plane and Adobe Commerce/Magento.
• One flaw is tracked as CVE-2026-5430 and involves path traversal.
• Unknown threat actors are actively exploiting these flaws.
• CISA added them to the Known Exploited Vulnerabilities catalog on a Thursday in September 2026.

In September 2026, on a Thursday, the Cybersecurity and Infrastructure Security Agency expanded its Known Exploited Vulnerabilities list by adding two critical security flaws. One of them is tracked as CVE-2026-5430, and both are path traversal vulnerabilities. The impacted offerings—WSO2 API Control Plane and Adobe Commerce/Magento—are broadly used platforms in enterprise and e-commerce settings.

Organizations that rely on WSO2's API management solution or Adobe's commerce platforms are at risk. The flaws allow attackers to manipulate file paths, potentially gaining unauthorized access to sensitive files or executing arbitrary code. Because these vulnerabilities are already being exploited in real-world attacks by unidentified threat actors, the window for proactive defense is narrow.

The inclusion in CISA's KEV catalog signals that the flaws pose a significant threat. Federal agencies are required to remediate known exploited vulnerabilities within a set timeframe, but private sector entities should treat this as an urgent priority as well. Active exploitation means that simply having an unpatched system exposed to the internet could lead to compromise.

While details about the attackers remain unknown, the path traversal vector is a common technique for initial access and lateral movement. Administrators should not wait for a full technical analysis before acting. Vendors are expected to release patches or mitigation guidance, and CISA's alert provides a clear call to action.

What to watch: monitor WSO2 and Adobe security advisories for updates, check for signs of exploitation such as unusual file access patterns, and ensure that all internet-facing instances are either patched or isolated. Given the critical nature of these flaws, assume that exploitation attempts are ongoing and prioritize remediation accordingly.

À faire maintenant

1. Immediately inventory all deployments of WSO2 API Control Plane and Adobe Commerce/Magento across your environment.
2. Apply vendor-supplied patches as soon as they become available; subscribe to WSO2 and Adobe security bulletins for updates.
3. If patches are not yet released, implement temporary mitigations such as disabling vulnerable endpoints, restricting network access, or enabling additional logging.
4. Review web server and application logs for path traversal patterns (e.g., '../' sequences) and other indicators of compromise.
5. Enforce network segmentation and least-privilege access for these services to limit the blast radius of any successful exploit.
6. Monitor CISA's KEV catalog and threat intelligence feeds for new information on CVE-2026-5430 and related flaws.
7. If compromise is suspected, conduct a thorough forensic investigation and rotate credentials for affected systems.

Références CVE

• CVE-2026-5430

Source originale

The Hacker News