CISA Flags Critical WSO2 and Adobe Commerce Flaws as Actively Exploited

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced Thursday that two high‑severity vulnerabilities affecting the open‑source integration platform WSO2 and the Adobe Commerce/Magento e‑commerce suite have been added to its Known Exploited Vulnerabilities (KEV) catalog after confirming real‑world attacks.

Both flaws are classified as critical, meaning they can be leveraged by threat actors to execute arbitrary code or gain unauthorized access to sensitive systems. CISA’s decision to list them in the KEV program signals that malicious actors are already weaponizing the weaknesses, prompting immediate attention from organizations that run these products in production environments.

WSO2, widely used for API management, identity federation and micro‑service orchestration, has long been a staple for enterprises building modern application architectures. A compromise of its core components could allow attackers to intercept, modify, or redirect traffic between services, potentially exposing confidential data or disrupting business operations. Adobe Commerce, the rebranded Magento platform, powers countless online stores; a breach there could enable theft of customer information, manipulation of transaction flows, or the insertion of malicious code into storefronts.

The inclusion of these vulnerabilities in the KEV list carries practical implications for federal agencies and private sector firms alike. CISA advises all affected entities to prioritize the deployment of vendor‑released patches, conduct thorough vulnerability scans, and monitor network traffic for indicators of compromise linked to the disclosed weaknesses. Organizations that cannot patch immediately are urged to implement compensating controls such as network segmentation, strict access controls, and intrusion‑detection signatures.

Both WSO2 and Adobe have responded by publishing security advisories and making patches available to customers. The rapid coordination between the vendors, security researchers, and CISA underscores the collaborative effort required to mitigate threats that quickly move from discovery to exploitation. As the KEV catalog continues to expand, cybersecurity teams are expected to keep a close eye on further updates, ensuring that remediation actions keep pace with the evolving threat landscape.