CISA lists WSO2's forged-token bypass as exploited on thin public evidence
CISA listed WSO2's maximum-severity JWT bypass, CVE-2026-5430, as exploited, with a September 27 federal fix deadline. The public evidence so far is forged-token attempts from one IP against the wrong WSO2 product, a thinner record than Sansec's sighting of live Magento attacks.
The Watch · Security desk
What happened
- CISA flagged four flaws as exploited, two of them critical: CVE-2026-5430 in WSO2 products and CVE-2026-71362 in Adobe Commerce.
- Federal agencies have until Sunday, September 27, to fix or stop using the two critical products, and until Monday, September 28, for the SharePoint and MikroTik bugs.
- CVE-2026-5430 has a maximum severity score and affects WSO2 API Manager 4.1.0 through 4.6.0, plus API Control Plane, Traffic Manager and Universal Gateway 4.5.0 and 4.6.0.
- watchTowr's honeypots caught a limited number of forged-JWT attempts from one IP address on September 13, aimed at the wrong WSO2 product for this flaw.
Why it matters
- What doesn't add up contradiction CISA's exploited label on CVE-2026-5430 goes further than anything public: until the agency shares what it saw, WSO2 users are judging the risk from attempts that missed.
- What's now possible capability Retargeting is the remaining step between the September 13 attempts and credential theft, since watchTowr's forged tokens worked once aimed at an affected WSO2 product.
- What it limits constraint Account controls and admin-rights hygiene do nothing to shrink exposure on an unpatched Magento store; only the update or a mitigation closes it.
Next story · Security · 10h ago
CISA adds Atlassian Data Center flaw CVE-2026-21589 to its exploited-vulnerabilities listConfirmed2 publishers
The WSO2 flaw is in token validation. The JWT authentication mechanism accepts tokens signed with an unsupported algorithm [17]. WSO2's original advisory, dated May 3, said an attacker who exploits it could compromise administrative accounts and take full control [5]. The attempts watchTowr recorded came 133 days after that advisory [16].
watchTowr then reran the attack against the product the flaw does affect. There, a forged token could expose API endpoints and application credentials [11]. A limited run of attempts from a single address is probing [19]. CISA has not shared any details about the attacks behind its listing [10], so nothing public yet ties CVE-2026-5430 to a sustained campaign.
"Its technology is used by nearly 1,000 customers across banking, government, telecommunications, and logistics," Yordan Ganchev, a threat intelligence specialist at watchTowr, told BleepingComputer [12]. "Organizations in these sectors can't afford to wait for exploitation to be formally confirmed," he said [13].
The Adobe Commerce entry has the firmer public record of the two critical bugs [7]. CVE-2026-71362 is an incorrect authorization flaw in Adobe's Commerce and Magento platforms [4]. Sansec said attackers require "no existing account, administrator privileges, or user interaction" to use it [8].
The other two entries carry lower ratings. CVE-2026-65660 is a high-severity code injection flaw in Microsoft SharePoint [6]. The MikroTik RouterOS bug, CVE-2026-67279, is rated medium, but it is a pre-authentication bypass of the SSH state machine and can be reached before any login [6].
The deadlines bind federal agencies [3]. CISA encourages all other organizations to prioritize the same KEV entries [14].
What to watch
- CISA or WSO2 publishing details of confirmed compromises behind the CVE-2026-5430 listing.
- watchTowr or other honeypot operators recording forged-JWT attempts against the affected API Manager and gateway versions.
- Sansec or Adobe tying CVE-2026-71362 exploitation to a named actor or a repeat campaign.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption25
- Hype gap+35
- Incentives40
- Confidence55
Perspective Coverage
4 publishers- Builder
- Builder 25%
- Operator
- Operator 65%
- Investor
- Investor 10%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CISA warns that hackers are exploiting CVE-2026-5430, a critical authentication bypass vulnerability affecting multiple products from WSO2.
- [2]
CISA added CVE-2026-71362, a critical-severity flaw affecting Adobe Commerce, to the list of security issues being leveraged in attacks.
- [3]
For the two critical issues added to the KEV catalog, federal agencies using the affected products have until Sunday, September 27, to apply the recommended updates or mitigations, or discontinue their use.
- [4]
CVE-2026-71362 is an incorrect authorization vulnerability in Adobe's Commerce and Magento e-commerce platforms.
- [5]
In its original advisory on May 3, WSO2 said an attacker successfully exploiting the vulnerability could compromise administrative accounts and take full control.
- [6]
Hackers are also exploiting CVE-2026-65660, a high-severity code injection flaw in Microsoft SharePoint, and CVE-2026-67279, a medium-severity pre-authentication SSH state-machine/workflow bypass in MikroTik RouterOS.
- [7]
Ecommerce security company Sansec observed CVE-2026-71362 being exploited in the wild.
- [8]
Sansec said threat actors require "no existing account, administrator privileges, or user interaction" to leverage CVE-2026-71362.
- [9]
CISA is giving agencies until Monday, September 28 to fix the Microsoft SharePoint and MikroTik RouterOS flaws.
- [10]
CISA has not shared any details about the attacks exploiting CVE-2026-5430.
- [11]
watchTowr reproduced the attack on the correct product, where a forged token could expose API endpoints and application credentials.
- [12]
"Its technology is used by nearly 1,000 customers across banking, government, telecommunications, and logistics," said Yordan Ganchev, threat intelligence specialist at watchTowr.
- [13]
"Organizations in these sectors can't afford to wait for exploitation to be formally confirmed."
- [14]
CISA encourages all organizations to take action and prioritize addressing the security issues listed in the KEV.
- [15]
CISA flagged four flaws as exploited in this round, two of them rated critical.
- [16]
watchTowr's recorded attempts on September 13 came 133 days after WSO2's May 3 advisory.
- [17]
CVE-2026-5430 stems from the JWT authentication mechanism accepting tokens signed with an unsupported algorithm.
- [18]
CVE-2026-5430 received a maximum severity score and impacts WSO2 API Manager versions 4.1.0 through 4.6.0, and API Control Plane, Traffic Manager, and Universal Gateway versions 4.5.0 and 4.6.0.
- [19]
watchTowr announced on September 15 that its honeypots captured a limited number of exploitation attempts from one IP address on September 13 using forged JWT tokens against a WSO2 product, but the attacker targeted the wrong product for CVE-2026-5430.
Sources
4 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comCISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks
1 article · September 25, 2026
- cisa.govCISA Adds Two Known Exploited Vulnerabilities to Catalog
1 article · September 24, 2026
- securityaffairs.comU.S. CISA adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog
1 article · September 25, 2026
- thehackernews.comWSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV
2 articles · September 25, 2026
Topics and entities
Topics
- Known Exploited Vulnerabilities catalog
- E-commerce Security
- API gateway security
Entities
- WatchTowr
- Sansec
- Adobe Commerce
- WSO2 API Manager
- Microsoft SharePoint
- Previdian
- WSO2
- MikroTik RouterOS
- CISA