[wso2]

September 27, 2026

• WSO2 CVE-2026-5430 (CVSS 9.8) and Adobe Commerce CVE-2026-71362 went into KEV with a federal remediation deadline of today, 27 September. The WSO2 flaw is a JWT authentication mechanism accepting tokens signed with an unsupported algorithm, affecting API Manager 4.1.0–4.6.0 plus API Control Plane, Traffic Manager and Universal Gateway 4.5.0/4.6.0; watchTowr's honeypots caught forged-JWT attempts from a single IP on 13 September — aimed at the wrong product — and then reproduced the attack against the correct one (BleepingComputer, The Hacker News). · Vulnerabilities & Exploits

in Citrix NetScaler Zero-Days Land Mid-Weekend, No Patch Until Next Week

September 17, 2026

• WSO2 API Manager's JWT bypass (CVE-2026-5430, CVSS 9.8) is being exploited: watchTowr honeypots captured tokens with administrator privileges baked in on 13 September. The service accepts tokens signed with algorithms it does not support and approves them anyway; API Manager 4.1.0–4.6.0, API Control Plane, Traffic Manager and Universal Gateway are affected, with fixes published in May. The Hacker News. · Active Exploitation

in One Extension Hijacks the AI Assistant in Five Major Browsers