CISA added two actively exploited flaws to its KEV catalog, including a critical 9.8-rated path traversal bug in WSO2 API Control Plane. Here's what you need to know.
### When a Vulnerability Gets "Exploited" Status, Pay Attention
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) doesn't add flaws to its Known Exploited Vulnerabilities (KEV) catalog lightly. So when it updated the list on Thursday with two critical issues affecting WSO2 and Adobe Commerce (along with Magento), it was a signal worth taking seriously.
That word "exploited" is doing a lot of work here. It means attackers aren't just theoretically capable of abusing these flaws — they're actively doing it in the wild. If you run either of these platforms, this isn't a someday problem. It's a today problem.
### The First Flaw: A Near-Perfect Score
Let's start with the one we know the most about.
**CVE-2026-5430** carries a CVSS score of **9.8** — which, for those keeping score at home, is about as close to a perfect 10 as a vulnerability gets. It's a path traversal vulnerability in the **WSO2 API Control Plane**.
If you're not deep in the weeds on security terminology, here's the plain-English version: path traversal means an attacker can trick the system into reaching files and directories it was never supposed to expose. Think of it like finding a side door in a building that technically exists but nobody remembered to lock.
Once inside, an attacker could potentially read sensitive configuration files, credentials, or other data that should have stayed hidden. With a 9.8 rating, the barrier to exploitation is low and the potential damage is high.
### Why the KEV Catalog Matters
You might be wondering why a government agency's list matters to you, especially if you're not a federal contractor.
Here's the thing: the KEV catalog isn't just a bureaucratic checkbox. It's a real-world signal that tells security teams where to point their attention first. When your to-do list is a mile long and your team is stretched thin, knowing which flaws are actively being weaponized helps you triage.
> "The KEV catalog exists because perfect patching is impossible. It's a way of saying: if you can only fix a handful of things this week, start here."
That's not a direct quote from anyone official — it's just the practical reality. Prioritization saves careers and, sometimes, companies.
### What You Should Do Next
If WSO2 API Control Plane or Adobe Commerce/Magento touches your infrastructure, here's a short action list:
- **Check your versions immediately.** Confirm whether you're running an affected release.
- **Apply vendor patches as soon as they're available.** Don't wait for a maintenance window if you can help it.
- **Review logs for signs of exploitation.** Path traversal attacks often leave traces — unusual file access patterns, strange requests, that sort of thing.
- **Consider temporary mitigations** if patching isn't possible right away, like restricting network access to the affected service.
- **Loop in your team.** Security is a group sport, and someone on your team may have context you don't.
### The Bigger Picture
Stories like this one pop up constantly, and it's easy to tune them out. But the pattern is worth noticing: attackers move fast, and the window between "vulnerability disclosed" and "actively exploited" keeps shrinking.
For teams running e-commerce platforms especially, the stakes are high. Adobe Commerce and Magento power a huge chunk of online stores, which means customer data, payment information, and business continuity are all on the line.
The takeaway isn't to panic. It's to build habits — patching routines, monitoring, and a healthy skepticism about "we'll get to it later." Because later, in security terms, has a way of arriving sooner than anyone expects.
