Two deadlines, both missed
The US Cybersecurity and Infrastructure Security Agency (CISA) gave federal civilian agencies until September 27, 2026 to patch or disconnect two products: WSO2's API gateway software and Adobe Commerce, the e-commerce platform that also ships as the open-source Magento. That deadline has now passed. Both flaws were already being exploited before CISA added them to its Known Exploited Vulnerabilities (KEV) catalog on September 24, so neither is a theoretical risk.
The two bugs have nothing in common except timing. One lets an attacker forge their way into administrator accounts on API infrastructure. The other lets a customer's shopping session be hijacked to impersonate someone else entirely. They landed in the same KEV batch as a Microsoft SharePoint code-injection flaw and a MikroTik RouterOS SSH bypass, which carry their own September 28 deadline and are not covered in detail here.
A forged signature is enough
CVE-2026-5430 sits in WSO2's API Control Plane, API Manager, Traffic Manager and Universal Gateway products. Per WSO2's own advisory (WSO2-2026-5328), the software will accept a JSON Web Token (JWT) signed with an algorithm it was never supposed to trust. An attacker who understands that flaw does not need a stolen password: a forged token is enough to pass as an authenticated administrator and, from there, take over the account outright. WSO2 rates the bug a maximum 10.0 on multi-tenant deployments and 9.8 on single-tenant ones, on the ten-point Common Vulnerability Scoring System (CVSS).
The affected versions span WSO2 API Manager 4.1.0 through 4.6.0, and API Control Plane, Traffic Manager and Universal Gateway 4.5.0 and 4.6.0.
Threat-hunting firm watchTowr said it picked up forged JWTs hitting its honeypots starting September 13, more than a week before any public technical writeup of the bug existed, and reverse-engineered the flaw itself to confirm what it was seeing. "We captured forged JWT tokens targeting the flaw on September 13 and reproduced the vulnerability ourselves, despite the lack of public technical details," said Yordan Ganchev, a principal threat intelligence specialist at watchTowr. Ganchev also noted that WSO2's software sits behind close to a thousand organizations spanning banking, government, telecommunications and logistics, which is what makes an unauthenticated path to admin access on this particular product so consequential.
A shopper's session, swapped for someone else's
CVE-2026-71362 is a different kind of bug in a different kind of product. It is an authorization flaw in Adobe Commerce and Magento that lets an attacker switch their own logged-in session so that it points at another customer's account instead, without needing that customer's password, without needing any admin privileges, and without the victim clicking anything. Once inside, the attacker sees whatever the real customer would see: order history, saved addresses, stored payment details.
Adobe rates the flaw 9.1 on the CVSS scale. It affects Adobe Commerce, Commerce B2B and Magento Open Source up to the patch level Adobe shipped in July 2026. Security firm Sansec, which specializes in e-commerce platform threats, said it first caught exploitation attempts in August 2026, not long after the vulnerability became public, meaning store operators who skipped the July patch have had roughly two months of exposure by the time the September 27 federal deadline arrived.
Why the deadline matters beyond government
CISA's KEV deadlines are binding only on federal civilian executive branch agencies, but the catalog functions as a de facto priority list for everyone else, because the entries are, by definition, bugs that are already being used in real attacks rather than ones that merely could be. A CVSS score in the 9-to-10 range on a piece of software with wide deployment is not automatically urgent; a lower-scoring bug that an adversary is actively weaponizing usually is, and both bugs here clear that bar simultaneously.
For WSO2 customers, the exposure is worse than a single storefront: API gateways sit in front of whatever backend systems they were deployed to protect, so a forged-admin-token attack can become a pivot point into everything behind the gateway. For Adobe Commerce and Magento merchants, the exposure is direct customer trust: a successful session hijack hands over exactly the data a shopper assumed was private to their own login.
What to do about it
WSO2 has published fixed builds for every affected product line in advisory WSO2-2026-5328; there is no supported way to mitigate the JWT flaw short of upgrading, since the bug is in how signatures are verified in the first place. Adobe Commerce and Magento operators who have not applied a patch since July 2026 should treat that as the priority gap to close, and should also review recent order and account activity for signs that a session-swap already happened, since the attack leaves few obvious traces beyond the access itself.
Both vendors' advisories include the exact build numbers that carry the fix, and neither flaw requires exotic tooling to exploit, which is precisely why both were being hit before most defenders had heard of them.
