CVE-2026-5430 & CVE-2026-71362: CISA KEV Adds WSO2 Path Traversal and Adobe Commerce Authorization Flaw — Detection and Remediation Guide

On September 24, 2026, CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog — and a KEV listing is never a formality. It means CISA has credible evidence of active exploitation in the wild. The two additions are:

• CVE-2026-5430 — a path traversal vulnerability affecting multiple WSO2 products
• CVE-2026-71362 — an incorrect authorization vulnerability in Adobe Commerce and Magento Open Source

Both vulnerability classes are bread-and-butter for initial access brokers and ransomware affiliates. Path traversal gives an unauthenticated attacker a read (and frequently a write) primitive on the host filesystem; broken authorization hands them privileged functionality without credentials. If you run WSO2 identity or integration products, or an Adobe Commerce/Magento storefront, treat this as an incident-response-tier priority, not a patch-Tuesday line item.

Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch agencies are required to remediate KEV-listed vulnerabilities on accelerated timelines based on risk. Private-sector organizations are not bound by BOD 26-04, but the KEV catalog remains the single most reliable triage signal we have — if CISA says it's being exploited, it is.

Technical Analysis

CVE-2026-5430 — WSO2 Multiple Products Path Traversal

Affected products: Multiple WSO2 products (per the CISA advisory). WSO2's portfolio — API Manager, Identity Server, Enterprise Integrator, and related carbon-platform products — shares a common codebase, which is why a single flaw frequently spans "multiple products." Consult the WSO2 security advisory for the exact affected version matrix for your deployed components.

How the vulnerability works (defender's view):

Path traversal (CWE-22) in a Java-based platform like WSO2 typically lives in an HTTP request handler that accepts a user-controlled file path, resource name, or upload/download parameter without canonicalizing and validating it against an allowed base directory. The exploitation chain defenders should assume:

1. Unauthenticated or low-privilege HTTP request to an exposed WSO2 endpoint (commonly the management console on 9443, or service endpoints on 8243/8280/9763) containing traversal sequences — ../, URL-encoded %2e%2e%2f, double-encoded %252e%252e%252f, or Unicode variants.
2. Arbitrary file read — attackers target /repository/conf/ configuration files (which historically contain JDBC credentials, keystore passwords, and admin secrets in WSO2 carbon products), /etc/passwd, or application property files.
3. Escalation to write/RCE — if the traversal lands in a file-upload or deployment handler, the attacker drops a JSP web shell into the webroot (e.g., under repository/deployment/server/webapps/ or the Tomcat webapps directory), achieving remote code execution as the WSO2 service account.

Exploitation status: Confirmed active exploitation (CISA KEV, added 2026-09-24).

CVE-2026-71362 — Adobe Commerce / Magento Incorrect Authorization

Affected products: Adobe Commerce and Magento Open Source. Adobe Commerce is one of the most-attacked e-commerce platforms on the internet precisely because a compromise yields payment data, PII, and a trusted foothold for web skimming.

How the vulnerability works (defender's view):

Incorrect authorization (CWE-863) means the application fails to verify that the requesting user or session is entitled to perform an action or access a resource. In Commerce/Magento, defenders should assume the exploitation chain:

1. Unauthenticated or customer-level request to a storefront, REST/GraphQL API, or admin-route endpoint that skips an authorization check.
2. Access to privileged functionality or data — order/customer data enumeration, price or configuration manipulation, or interaction with admin-scoped API operations.
3. Pivot to full compromise — incorrect authorization bugs in this ecosystem are routinely chained with mass-assignment, credential reset flows, or admin account creation, followed by deployment of card-skimming JavaScript or a PHP web shell in pub/ or generated static content directories.

Exploitation status: Confirmed active exploitation (CISA KEV, added 2026-09-24). Adobe's security bulletin (APSB series) provides the fixed release versions — apply the exact patch version listed there rather than assuming your current minor release is safe.

Detection & Response

These are web-facing vulnerabilities, so your highest-fidelity telemetry is web server / reverse proxy / WAF logs, application logs, and the process and file activity of the Java/PHP runtime on the host. The detections below target post-exploitation behavior as well as the exploit attempts themselves — because by the time a KEV entry drops, you need to hunt, not just block.

Sigma Rules

---
title: WSO2 Path Traversal Exploitation Attempt - CVE-2026-5430
id: 3f8a2b14-9c6d-4e71-a5b2-8d1e7f4a9c03
status: experimental
description: Detects path traversal sequences in HTTP requests targeting WSO2 carbon-platform endpoints, consistent with CVE-2026-5430 exploitation. Apply against web server, reverse proxy, or WAF logs fronting WSO2 products.
references:
  - https://www.cisa.gov/news-events/alerts/2026/09/24/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/09/26
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..\\'
      - '%2e%2e%2f'
      - '%2e%2e/'
      - '..%2f'
      - '%252e%252e%252f'
      - '..%c0%af'
  selection_target:
    cs-uri-stem|contains:
      - '/carbon/'
      - '/services/'
      - '/fileupload/'
      - '/authenticationendpoint/'
      - '/api/'
  condition: selection_traversal and selection_target
falsepositives:
  - Vulnerability scanners and sanctioned penetration tests
  - Rare misconfigured internal integrations passing relative paths
level: high
---
title: Web Shell Dropped by Java or PHP Web Runtime
id: 7c1e4d92-2b8f-4a63-9e05-5f3b6a1d8c47
status: experimental
description: Detects the WSO2 Java runtime or PHP-FPM/Apache writing script files to web-accessible directories, a hallmark of path-traversal-to-webshell and Magento compromise chains.
references:
  - https://www.cisa.gov/news-events/alerts/2026/09/24/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/09/26
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_creation
  product: linux
detection:
  selection_writer:
    Image|endswith:
      - '/java'
      - '/php-fpm'
      - '/php'
      - '/httpd'
      - '/apache2'
      - '/nginx'
  selection_path:
    TargetFilename|contains:
      - '/webapps/'
      - '/deployment/server/webapps/'
      - '/pub/static/'
      - '/pub/media/'
      - '/var/www/'
      - '/generated/'
  selection_ext:
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
      - '.php'
      - '.phtml'
  condition: selection_writer and selection_path and selection_ext
falsepositives:
  - Legitimate application deployments and Magento static-content generation (correlate with change windows)
level: high
---
title: Suspicious Magento Adobe Commerce Admin or API Authorization Abuse
id: 91b5c3e7-6d4a-48f2-b107-2e9c4f7a5d36
status: experimental
description: Detects requests to Magento/Adobe Commerce admin and integration API routes from sources without an established admin session pattern, consistent with CVE-2026-71362 incorrect-authorization probing. Tune the admin path to your custom backend frontName.
references:
  - https://www.cisa.gov/news-events/alerts/2026/09/24/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/09/26
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1078
logsource:
  category: webserver
detection:
  selection_admin:
    cs-uri-stem|contains:
      - '/admin/'
      - '/rest/V1/integration/admin/'
      - '/rest/default/V1/'
      - '/graphql'
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
      - 'DELETE'
  filter_status:
    sc-status:
      - '401'
      - '403'
  condition: selection_admin and selection_method and not filter_status
falsepositives:
  - Legitimate admin panels accessed via the custom backend frontName (add your frontName to the filter)
  - Sanctioned ERP/PIM integrations using integration tokens (whitelist their source IPs)
level: medium

Tuning note from the trenches: the third rule will be noisy until you whitelist your real integration IPs and your custom admin frontName. Do that work — a medium rule that fires 200 times a day gets disabled, and a disabled rule protects no one.

KQL (Microsoft Sentinel / Defender)

This query hunts WSO2 traversal attempts and Magento authorization probing across ingested web telemetry (W3CIISLog, CommonSecurityLog from WAF/proxy CEF, or AzureDiagnostics for App Gateway WAF). Run it over the last 14 days against your perimeter estate:

let traversalPatterns = dynamic(["../", "%2e%2e%2f", "%2e%2e/", "..%2f", "%252e%252e%252f", "..%c0%af"]);
let wso2Paths = dynamic(["/carbon/", "/services/", "/fileupload/", "/authenticationendpoint/"]);
let commercePaths = dynamic(["/rest/V1/", "/rest/default/V1/", "/graphql", "/admin/"]);
union isfuzzy=true
    (W3CIISLog
     | extend Uri = strcat(csUriStem, "?", csUriQuery)
     | extend SourceIP = cIP, Method = csMethod, Status = scStatus, Host = sComputerName),
    (CommonSecurityLog
     | extend Uri = strcat(RequestURL)
     | extend SourceIP = SourceIP, Method = RequestMethod, Status = tostring(Activity), Host = DeviceHostName)
| where Uri has_any (traversalPatterns) and Uri has_any (wso2Paths)
    or (Uri has_any (commercePaths) and Method in~ ("POST","PUT","DELETE") and Status !in ("401","403"))
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Requests=count(), DistinctURIs=dcount(Uri), SampleURIs=make_set(Uri, 10)
    by SourceIP, Host
| where Requests > 5 or DistinctURIs > 3
| sort by Requests desc

For post-exploitation hunting on the host itself (via Defender for Endpoint or MDE-on-Linux onboarding on your WSO2/Magento servers):

DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("java", "php", "php-fpm", "httpd", "apache2", "nginx", "wso2server.sh")
| where FileName in~ ("bash", "sh", "curl", "wget", "nc", "ncat", "python", "python3", "perl", "base64")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| sort by TimeGenerated desc

A Java process hosting your WSO2 server spawning curl, bash, or base64 is almost never legitimate. In a decade and a half of IR work, that single parent-child relationship has caught more web-shell follow-on activity than any signature.

Velociraptor VQL

For rapid triage of a suspected-compromised WSO2 or Magento host, hunt for web shells written after the KEV publication date and for the Java/PHP runtime holding suspicious child processes:

-- Identify recently created script files in web-accessible directories (potential web shells)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  '/opt/wso2/**/webapps/**/*.jsp',
  '/usr/share/wso2/**/webapps/**/*.jsp',
  '/var/www/**/pub/**/*.php',
  '/var/www/**/generated/**/*.phtml',
  '/var/www/html/**/*.php'
])
WHERE Mtime > '2026-09-20'
ORDER BY Mtime DESC

-- Find web runtime processes that spawned shells or downloaders
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(curl|wget|base64|/bin/sh|/bin/bash|nc -|chmod \+x)'
  AND (Name =~ 'java|php|httpd|apache2|nginx' OR Username =~ 'www-data|wso2|apache|nginx')

Remediation Script

Use the following Bash script to inventory exposed WSO2 listeners, check for web shells dropped since the KEV publication, and sweep Magento web roots for recently modified PHP — it gives you a fast compromise-assessment baseline while patching proceeds:

#!/bin/bash
# Security Arsenal - CVE-2026-5430 / CVE-2026-71362 rapid triage
# Run as root on suspected WSO2 / Magento hosts. Read-only; makes no changes.

REPORT="kev_triage_$(hostname)_$(date +%Y%m%d%H%M).txt"
echo "=== KEV Triage: $(hostname) - $(date) ===" | tee "$REPORT"

# 1. Identify running WSO2 / Java and PHP web processes
echo -e "\n[+] Web runtime processes:" | tee -a "$REPORT"
ps -eo pid,user,cmd | grep -Ei 'wso2|carbon|java|php-fpm|httpd|apache2|nginx' | grep -v grep | tee -a "$REPORT"

# 2. List exposed WSO2 / web listening ports
echo -e "\n[+] Listening ports (WSO2 defaults: 9443, 9763, 8243, 8280):" | tee -a "$REPORT"
ss -tlnp | grep -E '9443|9763|8243|8280|:80|:443' | tee -a "$REPORT"

# 3. Hunt for script files created/modified since 2026-09-20 in web roots
echo -e "\n[+] Recently modified scripts in web directories:" | tee -a "$REPORT"
for dir in /opt/wso2* /usr/share/wso2* /var/www /srv/www; do
  [ -d "$dir" ] && find "$dir" -newermt "2026-09-20" \( -name '*.jsp' -o -name '*.jspx' -o -name '*.php' -o -name '*.phtml' \) -printf '%T+ %p\n' 2>/dev/null | tee -a "$REPORT"
done

# 4. Sweep access logs for traversal sequences and admin/API abuse
echo -e "\n[+] Traversal indicators in web logs:" | tee -a "$REPORT"
grep -rhoE '(\.\./|%2e%2e%2f|%252e%252e|\.\.%2f)[^ ]*' /var/log/apache2/ /var/log/nginx/ /opt/wso2*/repository/logs/ 2>/dev/null | sort | uniq -c | sort -rn | head -50 | tee -a "$REPORT"

echo -e "\n[+] POST/PUT/DELETE to Magento admin & integration API (non-401/403):" | tee -a "$REPORT"
grep -hE '"(POST|PUT|DELETE)' /var/log/apache2/*access*.log /var/log/nginx/*access*.log 2>/dev/null | grep -E '/rest/(default/)?V1/|/graphql|/admin/' | grep -vE '" (401|403) ' | awk '{print $1, $7}' | sort | uniq -c | sort -rn | head -50 | tee -a "$REPORT"

# 5. Flag web-runtime child processes (potential web shell activity)
echo -e "\n[+] Suspicious child processes of web runtimes:" | tee -a "$REPORT"
ps -eo pid,ppid,user,cmd --forest | grep -A2 -Ei 'java|php-fpm|httpd|apache2|nginx' | grep -E 'bash|sh |curl|wget|nc |python|perl' | tee -a "$REPORT"

echo -e "\n=== Triage complete. Review $REPORT ===" 

Remediation

1. Patch — this is not optional.

• CVE-2026-5430 (WSO2): Apply the security update from WSO2's official security advisory for every affected product in your estate (API Manager, Identity Server, Enterprise Integrator, etc.). Verify the fixed build per the advisory — do not assume your current version is unaffected. Advisory portal: https://security.docs.wso2.com/
• CVE-2026-71362 (Adobe Commerce / Magento): Apply the patch release from Adobe's security bulletin (APSB series) at https://helpx.adobe.com/security.html. Use the exact fixed version listed for your release train, and re-run bin/magento setup:upgrade and static content deployment after patching.
• FCEB agencies: remediate within the deadline CISA assigns in the KEV catalog entry under BOD 26-04. Document remediation evidence — these entries are audited.

2. If you cannot patch immediately (compensating controls):

• Place a WAF or reverse proxy rule in front of WSO2 endpoints blocking any request containing ../, %2e%2e, %252e%252e, or ..%2f in the URI or parameters.
• Restrict network reachability of the WSO2 management console (9443) to administrative networks only — it should never be internet-exposed.
• For Commerce/Magento, restrict /admin/* and /rest/V1/integration/* routes by source IP at the load balancer or CDN until patched.

3. Assume breach — hunt before you close the ticket. Because both CVEs are confirmed exploited, patching alone is insufficient for internet-facing instances that were exposed while vulnerable:

• Run the triage script and the KQL/VQL hunts above against any host that was reachable prior to patching.
• Check for new local/admin users (Magento admin panel, WSO2 carbon user stores), unexpected OAuth/integration tokens, and cron or systemd persistence.
• Rotate credentials stored in WSO2 configuration files (keystore passwords, JDBC credentials, admin secrets) if file-read exposure is confirmed — assume they were harvested.
• For Commerce/Magento, audit outbound payment flows and injected JavaScript in templates/static content for skimmers, and review integration token creation events.

4. Structural hardening (post-incident):

• Enroll web-facing Java/PHP hosts in EDR with process-lineage visibility — the runtime-spawning-shell detection is your highest-value long-term control.
• Centralize WAF/proxy/application logs into your SIEM with retention sufficient for retro-hunts when the next KEV entry drops.
• Add KEV ingestion to your vulnerability management workflow: any KEV-listed CVE on an internet-facing asset should trigger an SLA measured in days, not the standard patch cycle.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub