CISA Alerts Organizations to Active Exploits of WSO2, SharePoint and Adobe Commerce Vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory warning that threat actors are actively exploiting a critical authentication‑bypass flaw identified as CVE‑2026‑5430 in several WSO2 products. The agency’s alert notes that the vulnerability enables attackers to circumvent login controls, potentially granting unauthorized access to sensitive corporate systems.

In addition to the WSO2 issue, CISA highlighted ongoing exploitation of separate security weaknesses in Microsoft SharePoint and Adobe Commerce platforms. Both flaws have been observed in the wild, allowing malicious actors to execute arbitrary code or manipulate data on compromised servers. The agency stresses that these attacks are not isolated incidents but part of a broader trend targeting enterprise software used across government and private sectors.

WSO2, a provider of open‑source middleware and identity‑management solutions, has released patches for the affected components, but the advisory indicates that many organizations have yet to apply the updates. The authentication bypass can be leveraged to obtain privileged credentials, making it a high‑impact vector for data exfiltration, ransomware deployment, or lateral movement within networks.

SharePoint, widely deployed for collaboration and document management, suffers from a vulnerability that permits remote code execution when specially crafted requests are processed. Similarly, Adobe Commerce (formerly Magento) faces a flaw that can be abused to inject malicious scripts into e‑commerce sites, jeopardizing customer information and payment data. Both vendors have published remediation guidance, yet the speed of exploitation suggests that unpatched installations remain attractive targets.

CISA’s advisory urges all federal agencies and private entities to prioritize patch deployment, conduct thorough vulnerability scans, and monitor authentication logs for anomalous activity. The agency also recommends implementing multi‑factor authentication, restricting network access to critical services, and employing intrusion‑detection tools to identify exploitation attempts in real time.

Experts note that the convergence of these exploits underscores the importance of a proactive cyber‑hygiene posture. While software vendors are issuing fixes, the window of exposure persists for organizations that lack robust patch‑management processes. Continued collaboration between government, industry, and security researchers will be essential to mitigate the immediate threat and prevent future abuse of similar authentication flaws.