Loading story…
CISA added CVE-2026-5430 affecting WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway, and CVE-2026-71362 affecting Adobe Commerce and Magento, to its Known Exploited Vulnerabilities catalog following evidence of active exploitation. The WSO2 flaw is a critical path-traversal issue that can permit unrestricted file uploads to unintended locations and potentially lead to remote code execution; exploitation has been observed since at least September 13. The Adobe/Magento authorization flaw enables unauthenticated customer-session switching, exposing private customer data and potentially allowing account hijacking or privilege escalation.
U.S. federal civilian executive-branch agencies must remediate both vulnerabilities by September 27, 2026, under CISA’s Binding Operational Directive process. Organizations operating affected WSO2 systems should inventory internet-facing deployments, apply vendor mitigations or remove unmitigated instances from service, and perform forensic triage for anomalous file writes, accounts, processes, logs, and outbound connections. Adobe Commerce and Magento administrators should apply Adobe’s available patches and review customer-session activity for signs of unauthorized access.
See which actors are running it and whether you're in range.
8 events from the most recent confirmed update back to the earliest known activity.
CIRT.cm issued alert CIRT-AL-2026-09-26 warning Cameroonian organizations about five critical vulnerabilities, including Arista CVE-2026-93952, which it stated was actively exploited and listed in CISA's Known Exploited Vulnerabilities catalog. The alert also reiterated active-exploitation warnings for the previously recorded WSO2 and Adobe Commerce flaws.
CISA added Microsoft SharePoint code-injection vulnerability CVE-2026-65660 and MikroTik RouterOS vulnerability CVE-2026-67279 to its Known Exploited Vulnerabilities catalog, citing active exploitation. Microsoft reported reliable attack evidence against SharePoint and CISA flagged it for forensic triage; MikroTik had released fixes for supported RouterOS branches.
watchTowr observed in-the-wild attempts to exploit the WSO2 path-traversal vulnerability CVE-2026-5430 against its honeypots. The flaw can allow unrestricted file uploads and potentially remote code execution.
Previdian telemetry recorded an attempt to exploit CVE-2026-71362 against its honeypot sensors. The activity originated from a single IP address in Australia.
CISA added actively exploited CVE-2026-5430 in WSO2 products and CVE-2026-71362 in Adobe Commerce and Magento to its Known Exploited Vulnerabilities catalog. CISA directed U.S. federal civilian executive-branch agencies to remediate both vulnerabilities by September 27, 2026.
Sansec detected and blocked exploitation attempts against CVE-2026-71362. The flaw can enable an attacker to switch a customer session to another account and access private customer data.
Adobe publicly disclosed the Adobe Commerce and Magento authorization flaw CVE-2026-71362 and released isolated patch files under advisory APSB26-92, which addressed seven vulnerabilities including the customer-account-takeover issue.
WSO2 released fixes for API Control Plane, API Manager, Traffic Manager, and Universal Gateway before exploitation of CVE-2026-5430 was confirmed. The JWT signature-verification flaw allows unauthenticated attackers to forge administrator tokens and bypass authentication.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
12 references tracked. Mallory keeps watching after this page renders.
boho.or.kr
Open sourcethecyberthrone.in
Open sourcegov.br
Open sourcecirt.cm
Open sourcethehackernews.com
Open sourcelabs.beazley.security
Open sourcecve.org
Open sourcecirt.gy
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2025-54236, an improper input validation flaw in Adobe Commerce and Magento, and CVE-2025-59287, a deserialization of untrusted data vulnerability in Microsoft Windows Server Update Service (WSUS). These vulnerabilities have been confirmed as being exploited in the wild, prompting CISA to require Federal Civilian Executive Branch (FCEB) agencies to remediate them under Binding Operational Directive (BOD) 22-01. CISA also strongly urges all organizations to prioritize patching these vulnerabilities to reduce exposure to cyberattacks. Security researchers have observed widespread exploitation of the Adobe Commerce vulnerability, dubbed "SessionReaper," with over 250 attacks detected in a 24-hour period targeting e-commerce sites via the REST API. Attackers have used this flaw to hijack customer accounts and deploy PHP webshells, while only 38% of affected stores have reportedly applied the available emergency patch. The Microsoft WSUS vulnerability allows unauthorized remote code execution via network exploitation, further increasing the risk to unpatched systems. Both vulnerabilities are considered critical, with public exploit details available, underscoring the urgency for immediate remediation.
Jul 12, 2026
Adobe released an out-of-band fix for **CVE-2025-54236**, a critical improper input validation flaw in **Adobe Commerce**, **Adobe Commerce B2B**, and **Magento Open Source** that allows unauthenticated attackers to take over user sessions through vulnerable session-handling and Web API components. The bug, dubbed **"SessionReaper"** by Sansec, carries a reported **CVSS 9.1** rating and can lead to account hijacking, exposure of customer data, fraudulent orders, administrative access, and in some scenarios potentially remote code execution. Affected releases span multiple 2.4.x branches, including versions from **2.4.4 through 2.4.7** and other listed builds and earlier releases. Security guidance escalated after reports said the flaw was being actively exploited in the wild and added to **CISA's Known Exploited Vulnerabilities** catalog. Adobe published remediation details in **APSB25-88** and shipped patched versions, while defenders were urged to apply the vendor fix immediately, verify patch status, review logs for anomalous session activity, tighten administrative access, and increase **WAF**, API, and **SIEM** monitoring. Advisories also warned that leaked hotfix details and unofficial fixes could accelerate attacker weaponization or create additional risk.
Jun 29, 2026
Adobe issued security updates for multiple vulnerabilities in **Adobe Commerce**, Adobe Commerce B2B, and Magento Open Source, including `CVE-2026-71362`, which open-source reporting indicates is being actively exploited in the wild. The broader advisory also covers Adobe Campaign Classic, ColdFusion, Content Credentials tools and SDKs, and Lightroom Classic. The Commerce flaws are remotely exploitable and may enable arbitrary code execution, malicious script injection into web forms, disclosure of sensitive information, security-control bypasses, privileged access to restricted files, and temporary denial of service. NCSC Netherlands, Guyana CIRT, and bjCSIRT urged administrators to apply Adobe's updates immediately; NCSC reported no known public proof-of-concept or exploit code for the vulnerabilities it described.
Sep 12, 2026