CISA KEV catalog reportedly adds critical WSO2 and Adobe Commerce flaws
SecurityUnverifiedUpdated:
CISA's Known Exploited Vulnerabilities catalog has reportedly gained two critical enterprise-software flaws affecting WSO2 and Adobe Commerce, while the same alert describes active exploitation of SharePoint and MikroTik RouterOS vulnerabilities.
Exploitation warnings across four products
BleepingComputer reported that CISA warned of exploitation involving four vulnerabilities: WSO2 CVE-2026-5430, Adobe Commerce CVE-2026-71362, Microsoft SharePoint CVE-2026-65660, and MikroTik RouterOS CVE-2026-67279.
The report says the WSO2 and Adobe Commerce issues were added to CISA's KEV catalog. It says federal agencies using those affected products have until September 27 to apply recommended updates or mitigations, or discontinue use; agencies have until September 28 for the SharePoint and RouterOS flaws.
The report identifies the KEV catalog update but does not provide a comparable earlier catalog state beyond saying the two critical vulnerabilities were added.
According to the report, CISA added the critical WSO2 authentication-bypass flaw CVE-2026-5430 and Adobe Commerce authorization flaw CVE-2026-71362 to its Known Exploited Vulnerabilities catalog, with a September 27 remediation-or-discontinuation deadline for federal agencies using the affected products.
Separate September 27 and 28 deadlines
KEV inclusion is an operational security change for federal agencies using the named products. The reported deadlines distinguish the two critical WSO2 and Adobe Commerce issues from the SharePoint and RouterOS vulnerabilities.
Sources
- BleepingComputerCISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacksRead source →