CISA KEV Alert: WSO2, SharePoint & Adobe Commerce Exploited

Executive Summary

The Cybersecurity and Infrastructure Security Agency (CISA) has added four high-impact enterprise vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation by persistent threat actors. Headlining the alert is CVE-2026-5430, a maximum severity (CVSS 10.0 / 9.8) authentication bypass impacting WSO2 API Manager, API Control Plane, Traffic Manager, and Universal Gateway products. The agency also mandated urgent remediation for CVE-2026-71362, an authorization flaw in Adobe Commerce and Magento, a code injection flaw in Microsoft SharePoint (CVE-2026-65660), and an SSH state-machine bypass in MikroTik RouterOS (CVE-2026-67279).

Pursuant to Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch (FCEB) agencies must patch or discontinue use of the critical WSO2 and Adobe Commerce systems by September 27, and the SharePoint and MikroTik assets by September 28. WSO2's API management infrastructure is deployed across approximately 1,000 major organizations spanning banking, government, telecommunications, and logistics, making this widespread campaign a severe enterprise supply chain risk.

Technical Vulnerability Analysis & Attack Chain

The most severe flaw, CVE-2026-5430 in WSO2 API Manager (versions 4.1.0 through 4.6.0), stems from improper cryptographic verification within the JSON Web Token (JWT) authentication validation routine. The gateway's token parser fails to enforce strict algorithm allowlisting during signature verification. When an incoming HTTP request supplies a crafted JWT token claiming an unsupported, custom, or none algorithm, the validation parser defaults to a permissive verification state.

This flaw allows unauthenticated remote attackers to forge administrative JWT claims. By submitting the forged token to WSO2 API management endpoints, adversaries bypass authentication filters entirely, seizing administrative control of the API Control Plane. Threat intelligence researchers at watchTowr confirmed honeypot detection of threat actors actively probing and exploiting this vulnerability in the wild to expose protected API endpoints and harvest backend application credentials.

Concurrently, threat actors are exploiting CVE-2026-71362 in Adobe Commerce and Magento Open Source. Threat intelligence from ecommerce security firm Sansec confirms that adversaries require zero existing user accounts, no administrative privileges, and no victim interaction to exploit this incorrect authorization flaw. Intruders weaponize the access to inject malicious JavaScript credit card skimmers directly into checkout workflows or deploy administrative backdoors.

On Microsoft SharePoint, attackers are weaponizing CVE-2026-65660, a high-severity remote code injection flaw that allows authenticated or context-escalated intruders to execute arbitrary server-side code within the SharePoint worker process context. In parallel, CVE-2026-67279 in MikroTik RouterOS allows pre-authentication adversaries to exploit a state-machine flaw in the SSH service, bypassing access controls to manipulate routing tables and establish covert perimeter pivot nodes.

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

Threat Actor Profile & Campaign Attribution

Honeypot telemetry from watchTowr and telemetry from Sansec confirm that multiple distinct threat clusters are actively targeting these assets. WSO2 API Gateways represent tier-one enterprise choke points, making them prime targets for state-sponsored cyber espionage operators seeking long-term persistent access to banking transactions, telecommunications metadata, and government API backends.

Simultaneously, financially motivated cybercrime cartels and e-skimming syndicates (Magecart groups) are weaponizing the Adobe Commerce authorization bug to compromise thousands of merchant checkout pages ahead of seasonal shopping peaks. Ransomware access brokers (IABs) are actively incorporating the SharePoint code injection and MikroTik router exploits into automated initial access playbooks to breach corporate perimeter perimeters.

Detection & SOC Mitigation Playbook

1. Patch & Workaround Guidance

• WSO2 API Manager: Apply official vendor security hotfixes immediately for WSO2 API Manager 4.1.0 through 4.6.0, API Control Plane, Traffic Manager, and Universal Gateway 4.5.0/4.6.0. Ensure JWT token validation policies strictly mandate RS256/ES256 algorithms and reject unsupported algorithms.
• Adobe Commerce / Magento: Update installations immediately to the latest patched releases (e.g., 2.4.7-p1 or applicable security hotfix). Audit the codebase for unauthorized files in pub/static and app/code.
• Microsoft SharePoint: Apply the September cumulative security updates across all SharePoint On-Premises server farms.
• MikroTik RouterOS: Upgrade RouterOS firmware to the latest stable release (v7.15+ or vendor hotfix) and disable external SSH WAN access.

2. Network & Perimeter Defenses

• WSO2 Perimeter Isolation: Restrict management consoles and internal API Control Plane ports (e.g. 9443, 9099) strictly to internal management networks and VPNs.
• JWT Header Inspection at WAF: Configure edge firewalls to inspect incoming Authorization: Bearer headers. Block any JWT tokens declaring "alg": "none" or unrecognized signing algorithm identifiers.
• Edge Router Management Hardening: Restrict MikroTik RouterOS WinBox (port 8291) and SSH (port 22) interfaces to internal jump hosts.

3. Endpoint Detection & Hunting Query

Security Operations Center (SOC) teams should hunt for suspicious JWT header manipulations targeting WSO2 endpoints and anomalous processes spawning from SharePoint application pools.

title: WSO2 API Manager Forged JWT Authentication Bypass
id: d492e811-1904-4b92-8811-wso2kev049
status: experimental
description: Detects incoming HTTP requests to WSO2 API Manager endpoints containing forged JWT tokens or anomalous authorization headers
author: CyberNewsAI Threat Intelligence
references:
  - https://www.bleepingcomputer.com/news/security/cisa-warns-of-sharepoint-wso2-adobe-commerce-flaws-exploited-in-attacks/
logsource:
  category: webserver
detection:
  selection_wso2_paths:
    cs-uri-stem|contains:
      - '/api/am/'
      - '/carbon/'
      - '/publisher'
      - '/devportal'
      - '/services/'
  selection_auth_anomaly:
    cs-header|contains:
      - 'Bearer e30.'
      - 'eyJhbGciOiJub25l'
      - 'eyJhbGciOiIi'
  condition: selection_wso2_paths and selection_auth_anomaly
fields:
  - c-ip
  - cs-method
  - cs-uri-stem
  - cs-header
  - sc-status
falsepositives:
  - Internal synthetic testing in non-production environments
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1556

Hunting query for Splunk (WSO2 & SharePoint anomalous execution):

index=web_access sourcetype IN ("access_combined", "iis", "wso2_http_access")
| where (like(uri_path, "%/api/am/admin/%") OR like(uri_path, "%/carbon/%") OR like(uri_path, "%/_layouts/%"))
| eval is_suspicious_auth=if(like(req_header, "%eyJhbGciOiJub25l%") OR like(req_header, "%Bearer e30.%"), 1, 0)
| eval is_server_error=if(status >= 500, 1, 0)
| stats count min(_time) as first_seen max(_time) as last_seen sum(is_suspicious_auth) as auth_bypass_attempts by clientip, method, uri_path, status, useragent
| where auth_bypass_attempts > 0 OR (status=200 AND count > 20)
| sort - auth_bypass_attempts, count

Actively Exploited CVE Identifiers & Flaw Attributes