Do Son CISA added two exploited CISA KEV vulnerabilities to its catalog. Patch WSO2 and Adobe Commerce to secure systems against active attacks.
WSO2
WSO2 patched four critical account takeover flaws, including CVE-2026-5430 at CVSS 10 via JWT auth bypass. Details and fixes inside.
WSO2 patched seven flaws across API Manager and gateways, led by a CVSS 10 JWT auth bypass (CVE-2026-5430). Update WSO2 API Manager now.
WSO2 patched three Critical flaws (CVSS 9.8) in API Manager/Identity Server. Flaws in regex access control and case-sensitive HTTP methods allow unauthenticated administrative takeover.
WSO2 patched two Critical flaws: CVE-2025-10611 (CVSS 9.8) allows unauthenticated admin bypass of System REST APIs, and CVE-2025-9804 (CVSS 9.6) allows privilege escalation via SOAP services.
A critical WSO2 vulnerability (CVE-2024-6914, CVSS 9.8) allows unauthenticated account takeover via a SOAP service, including admin access.
A critical XXE vulnerability (CVE-2025-2905) in WSO2 API Manager allows attackers to read files and cause DoS. Patch WSO2-2016-0151 is the solution.