The US Cybersecurity and Infrastructure Security Agency (CISA) has added two unrelated but equally serious flaws to its Known Exploited Vulnerabilities catalog this week — one in WSO2's integration and identity products, the other in Adobe Commerce and Magento, the software behind a large share of the internet's online stores. Both are already being used in real attacks, and federal agencies have been given until 27 September 2026 to patch. That deadline only binds US government systems, but CISA's KEV list is widely treated as an authoritative "these are being exploited right now" signal for everyone else, too.
The WSO2 flaw (CVE-2026-5430, CVSS 9.8) is a path-traversal bug that lets an attacker walk outside a restricted directory and reach files or functions they shouldn't be able to touch, ultimately leading to remote code execution — no valid account needed. Researchers have tracked exploitation attempts since mid-September. The Adobe Commerce flaw (CVE-2026-71362, CVSS 9.1) is arguably the more dangerous one for small and mid-sized businesses: it lets an unauthenticated attacker hijack customer sessions and take over accounts on a live Magento store, and security firm Sansec has evidence it was already being abused in the wild since August, weeks before a patch existed.
What this means for your business
If you run an online store on Adobe Commerce or Magento, treat this as urgent: confirm with whoever manages your store's hosting or development that the September security patch has been applied, and if you're not sure who that is, that gap is itself worth fixing this week. An unpatched store isn't just a technical risk — a hijacked customer account on a live storefront can mean stolen order histories, saved addresses, or fraudulent purchases charged to a real customer, which becomes your problem to explain. If your business (or a vendor you rely on) uses WSO2 for API management, identity, or single sign-on, the same urgency applies: check for an available patch and apply it, and in the meantime review access logs for anything unusual. Neither flaw is exotic or hard to exploit, which is exactly why both made CISA's list the same week.