CISA's KEV List Just Got Two New Critical Additions — Here's Why It Matters

Michael Miller · 2026-09-25

### What Just Happened The U.S. Cybersecurity and Infrastructure Security Agency (CISA) dropped a quiet but important update on Thursday. They added two critical security flaws — one affecting WSO2 and another impacting Adobe Commerce and Magento — to their Known Exploited Vulnerabilities (KEV) catalog. Translation? These aren't just theoretical bugs. Attackers are actively using them in the wild right now. That's a big deal. The KEV catalog isn't a "maybe someday" list. It's a "this is happening" list. Once a vulnerability lands there, federal agencies have a deadline to patch it, and security teams everywhere should treat it like a five-alarm fire. ### The WSO2 Flaw: CVE-2026-5430 Let's talk about the first one. CVE-2026-5430 carries a CVSS score of 9.8 out of 10. That's about as bad as it gets. It's a path traversal vulnerability in the WSO2 API Control Plane. Path traversal — sometimes called directory traversal — is one of those classic attack techniques where someone tricks a system into accessing files or directories it shouldn't. Think of it like convincing a hotel front desk to hand over a master key by pretending you're the manager. Once an attacker pulls that off, they can potentially reach sensitive configuration files, credentials, or other systems behind the scenes. With a 9.8 score, this isn't a minor inconvenience. It's a serious exposure for anyone running the affected WSO2 components. ### The Adobe Commerce and Magento Problem The second vulnerability targets Adobe Commerce and Magento, two platforms that power a massive chunk of online stores. If you run an e-commerce site on either of these, your ears should perk up. Adobe Commerce and Magento are used by businesses of all sizes, from small shops to enterprise retailers moving serious volume. That reach is exactly why attackers love targeting them. One exploit, thousands of potential victims. CISA doesn't add things to KEV lightly. The fact that this made the list means there's real evidence of exploitation — not just a proof of concept sitting on some researcher's laptop. ### Why the KEV Catalog Matters More Than You Think Here's the thing about the KEV catalog: it's not just a suggestion box. It's a federal mandate trigger. Once a vulnerability is listed, U.S. federal agencies have a set window — usually a few weeks — to patch it or stop using the affected product. But even if you're not a federal agency, the KEV list is one of the best early warning systems in cybersecurity. It tells you what attackers are actually doing, not what they might do someday. > "The KEV catalog is essentially a hit list written by the attackers themselves. If your software is on it, you're already in someone's crosshairs." That's why security pros check it regularly. It's the closest thing we have to a live threat feed. ### What You Should Do Right Now If you're running WSO2 API Control Plane, Adobe Commerce, or Magento, don't wait. Here's your action plan: - Check whether your version is affected by CVE-2026-5430 or the Adobe/Magento flaw - Apply vendor patches immediately — don't schedule them for "next sprint" - Review logs for signs of path traversal attempts or unusual file access - Rotate credentials if you suspect any exposure - Monitor the KEV catalog for future additions relevant to your stack Patching isn't glamorous. But it's the difference between being a victim and being prepared. ### The Bigger Picture Vulnerabilities like these keep showing up because attackers never stop looking for cracks. WSO2 and Adobe are just the latest names on a long list. Tomorrow it'll be someone else. The lesson? Stay current, stay paranoid, and treat the KEV catalog like the early warning system it is. Because by the time a flaw makes that list, the clock is already ticking.