Federal agencies face imminent patching deadlines after the Cybersecurity and Infrastructure Security Agency (CISA) added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, two of which carry critical severity ratings and are already being targeted by attackers.

The most urgent threat involves CVE-2026-5430, a critical authentication bypass in multiple WSO2 products. The flaw affects WSO2 API Manager versions 4.1.0 through 4.6.0, as well as API Control Plane, Traffic Manager, and Universal Gateway versions 4.5.0 and 4.6.0. According to WSO2's original advisory from May 3, successful exploitation could grant attackers administrative access and complete system control. The vulnerability stems from the JWT authentication mechanism accepting tokens signed with unsupported algorithms.

Security firm watchTowr reported on September 15 that its honeypots had detected exploitation attempts. Researchers observed a limited number of attacks originating from a single IP address on September 13, using forged JWT tokens. While the initial attacker targeted the wrong product, watchTowr's own testing confirmed that forged tokens could expose API endpoints and application credentials when used against the correct WSO2 product.

Yordan Ganchev, threat intelligence specialist at watchTowr, emphasized the significance of WSO2's customer base: "Its technology is used by nearly 1,000 customers across banking, government, telecommunications, and logistics." He added that "Organizations in these sectors can't afford to wait for exploitation to be formally confirmed."

The second critical vulnerability added to CISA's KEV list is CVE-2026-71362, an incorrect authorization flaw in Adobe Commerce and Magento platforms. E-commerce security firm Sansec has documented active exploitation in the wild, noting that threat actors require "no existing account, administrator privileges, or user interaction" to exploit the vulnerability.

Two additional flaws rounded out the advisory: CVE-2026-65660, a high-severity code injection vulnerability in Microsoft SharePoint, and CVE-2026-67279, a medium-severity pre-authentication SSH state-machine and workflow bypass affecting Mikrotik RouterOS.

Patching timeline

Federal agencies must address the two critical vulnerabilities by Sunday, September 27, either by applying patches, implementing mitigations, or discontinuing use of affected products. The SharePoint and RouterOS flaws carry a slightly later deadline of Monday, September 28. CISA has urged all organizations, not just federal agencies, to prioritize remediation of the vulnerabilities listed in the KEV catalog.