CISA adds WSO2 CVE-2026-5430 and Adobe Commerce/Magento CVE-2026-71362 to KEV catalog over active exploitation
CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2026-5430, a path traversal flaw in multiple WSO2 products, and CVE-2026-71362, an incorrect authorization flaw in Adobe Commerce and Magento. CISA describes these vulnerability types as a frequent attack vector for malicious cyber actors and a significant risk to the federal enterprise. The alert gives no technical exploitation details, threat actor attribution, victim information or IOCs. It restates the requirements of BOD 26-04 for Federal Civilian Executive Branch (FCEB) agencies, and CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV remediation.
Technical Details
- CVE-2026-5430: WSO2 Multiple Products Path Traversal Vulnerability.
- CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability.
- The article does not list affected versions, exploitation methods or whether the flaws are chained.
Remediation
- Under BOD 26-04, FCEB agencies must prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control of the asset after exploitation.
- BOD 26-04 also sets basic expectations for when agencies must check whether threat actors compromised a system before the patch was applied.
- CISA encourages all organizations to prioritize remediation of KEV Catalog vulnerabilities.
- The article gives no specific patch or mitigation guidance; consult the vendor advisories from WSO2 and Adobe.
Linha do tempo
-
CISA adds WSO2 CVE-2026-5430 and Adobe Commerce/Magento CVE-2026-71362 to KEV catalog over active exploitation
ler a análise desta fonte ocultar
CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2026-5430, a path traversal flaw in multiple WSO2 products, and CVE-2026-71362, an incorrect authorization flaw in Adobe Commerce and Magento. CISA describes these vulnerability types as a frequent attack vector for malicious cyber actors and a significant risk to the federal enterprise. The alert gives no technical exploitation details, threat actor attribution, victim information or IOCs. It restates the requirements of BOD 26-04 for Federal Civilian Executive Branch (FCEB) agencies, and CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV remediation.
Technical Details
- CVE-2026-5430: WSO2 Multiple Products Path Traversal Vulnerability.
- CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability.
- The article does not list affected versions, exploitation methods or whether the flaws are chained.
Remediation
- Under BOD 26-04, FCEB agencies must prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control of the asset after exploitation.
- BOD 26-04 also sets basic expectations for when agencies must check whether threat actors compromised a system before the patch was applied.
- CISA encourages all organizations to prioritize remediation of KEV Catalog vulnerabilities.
- The article gives no specific patch or mitigation guidance; consult the vendor advisories from WSO2 and Adobe.