CISA Adds WSO2 Path Traversal and Adobe Authorization Flaws to KEV After Honeypot Detections

CISA's KEV listing mandates FCEB patching by 27 September for both CVEs. CVE-2026-5430 permits unrestricted file upload in WSO2 API Manager and Gateway components through forged JWTs, enabling remote code execution without authentication. CVE-2026-71362 allows attackers to swap customer sessions in Adobe Commerce and Magento, exposing private account data. The additions reflect telemetry from multiple sensors rather than vendor confirmation alone. watchTowr recorded forged JWT exploitation attempts against honeypots starting 13 September and reproduced the WSO2 flaw despite absent public details. Sansec blocked Adobe session-swapping probes in August. Previdian logged a single Australian IP targeting its sensors on 10 September. These independent detections predate the KEV entry by days to weeks, showing attackers prioritized high-value API and e-commerce infrastructure in banking and government sectors before formal disclosure. WSO2 deployments span nearly 1,000 customers in regulated industries where API gateways serve as persistent access points. The pattern matches prior supply-chain targeting of identity and integration platforms, where initial RCE yields long-term persistence rather than immediate data theft. Adobe's lack of updated advisory on exploitation status creates a gap between vendor posture and observed activity. Federal agencies must complete remediation within eight days. Unpatched instances will likely see continued scanning and exploitation attempts, particularly against WSO2 instances lacking JWT validation hardening. Secondary effects include potential lateral movement into connected logistics and telecom networks.