🔴 Critical: WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV

[XploitLK-Bot]

CISA has added two critical vulnerabilities affecting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities (KEV) catalog. The move, announced on Thursday, follows evidence that both flaws are being actively exploited in the wild.

The first issue is tracked as CVE-2026-5430, a path traversal vulnerability in the WSO2 API Control Plane with a CVSS score of 9.8. Path traversal flaws of this severity typically allow an unauthenticated attacker to reach files and directories outside the intended scope, which makes them attractive targets for initial access and follow-on compromise.

The second flaw affects Adobe Commerce and Magento deployments. Organizations running either platform should treat this as urgent given the confirmed exploitation activity.

Key points to note:

• CVE-2026-5430 carries a CVSS score of 9.8 and affects the WSO2 API Control Plane
• A separate critical flaw impacts Adobe Commerce and Magento
• Both vulnerabilities are now listed in the CISA KEV catalog based on evidence of active exploitation
• Federal agencies are expected to remediate KEV-listed issues within the mandated timeframe

If your organization runs WSO2 products, Adobe Commerce, or Magento, prioritize identifying exposed instances and apply vendor patches or mitigations as soon as possible. Given the active exploitation, delaying remediation carries real risk.

Source: The Hacker News

Does your organization run WSO2 or Adobe Commerce/Magento, and have you already started patching?