{"uuid": "9781cdfc-94ac-4d8e-a541-4dc59ed3c1c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "exploited", "source": "https://t.me/baseleeak/404", "content": "4 Vulnerabilities Already Under Attack: CISA Adds SharePoint, WSO2, MikroTik, and Adobe Commerce to Catalog\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities to its catalog of flaws known to be exploited in the wild. The security gaps affect Microsoft SharePoint servers, WSO2 API management products, Adobe Commerce and Magento e-commerce stores, and devices running MikroTik RouterOS. For some of these vulnerabilities, attackers require no credentials or user interaction to succeed.\nThe most critical flaw, CVE-2026-5430, affects WSO2 API Manager versions 4.1.0\u20134.6.0, as well as API Control Plane, Traffic Manager, and Universal Gateway versions 4.5.0 and 4.6.0. WSO2 assigned the vulnerability a maximum CVSS score of 10 for certain configurations, warning that a successful attack allows for full account takeover, including administrative access.\nThe flaw stems from the validation process of JSON Web Tokens (JWT), which act as digital passes between applications and services. WSO2 accepted tokens signed with an unsupported algorithm, allowing malicious actors to forge tokens and bypass authentication. The vendor released patches in the spring and recommends installing the relevant updates or upgrading to an unaffected version.\nThe second critical vulnerability, CVE-2026-71362 (CVSS score: 9.1), impacts Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. An authorization bypass flaw allows unauthenticated attackers to gain access to customer accounts. Experts at Sansec, who analyzed the patch, discovered that the system incorrectly handled user identity within a session, enabling an attacker to switch the session to another client and access their profile and personal data.\nAdobe addressed CVE-2026-71362 in its August update (APSB26-92). At the time of the advisory's release, the company stated it had no evidence of active exploitation. However, Sansec claimed its security systems had already blocked attempts to exploit CVE-2026-71362. Its inclusion in the CISA catalog now confirms that active exploitation has moved beyond lab proof-of-concepts.\nMicrosoft SharePoint is being targeted via CVE-2026-65660 (CVSS score: 8.8). The flaw allows a low-privileged user to inject and execute code on the server over the network. Microsoft patched the vulnerability in August for SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Unlike the flaws in WSO2 and Adobe Commerce, exploiting CVE-2026-65660 requires a valid user account.\nThe fourth vulnerability, CVE-2026-67279, is located in the SSH server of MikroTik RouterOS. Under a specific sequence of actions, RouterOS began processing commands before the user authentication process was fully completed. As a result, an unauthenticated remote client could create, modify, and restore files within the accessible RouterOS directory, including configuration files and diagnostic data. Researchers described the issue after analyzing the September updates.\nMikroTik resolved the related flaws in RouterOS versions 6.49.21, 7.23.4, 7.24.2, and 7.25 beta 3. The company advises against leaving SSH exposed to untrusted networks. Following the update, administrators should inspect devices for unknown users, scripts, or other configuration changes. RouterOS may also label a device as \"Flagged\" if it detects known indicators of compromise.\nCISA has not disclosed who is exploiting these four vulnerabilities or which organizations are being targeted. U.S. federal agencies are required to remediate CVE-2026-5430 and CVE-2026-71362 by September 27, and CVE-2026-65660 and CVE-2026-67279 by September 28. For other organizations, inclusion in the CISA catalog serves as a high-priority alert that updates must be deployed immediately given the confirmed active exploitation, and internet-facing systems should be checked for signs of breach.\n\n____", "creation_timestamp": "2026-09-28T19:54:03.000000Z"}