CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks

The Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, warning that they are actively exploited in attacks. These include a critical authentication bypass flaw (CVE-2026-5430) in WSO2 products, an incorrect authorization vulnerability (CVE-2026-71362) in Adobe Commerce and Magento, a high-severity code injection flaw (CVE-2026-65660) in Microsoft SharePoint, and a medium-severity SSH state-machine bypass (CVE-2026-67279) in Mikrotik RouterOS. Security firm watchTowr observed exploitation attempts against WSO2 using forged JWT tokens, and Sansec reported active exploitation of the Adobe Commerce flaw in the wild. Federal agencies are required to patch these flaws by September 27–28, 2026.

AI-extracted · verify before operational use