Attackers are actively exploiting a maximum-severity flaw in WSO2’s API management products. On September 24, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-5430 to its Known Exploited Vulnerabilities (KEV) catalog. The listing matters because WSO2 gateways often sit directly in front of the APIs, authentication services, and application traffic that organizations rely on every day.
Federal civilian agencies have an unusually short window to act. CISA set a remediation deadline of September 27, only three days after the listing. The flaw carries a CVSS v3.1 score of 10.0 under one scoring scenario, the highest rating the system allows.
CISA wants more than a patch. The agency flagged the vulnerability for forensic triage under Binding Operational Directive 26-04, which means defenders are expected to check whether they were already compromised. According to the KEV entry, it is not yet known whether ransomware groups are using the flaw.
What CISA Is Requiring
The key details from CISA’s listing and the associated CVE record are below.
| Item | Detail |
|---|---|
| Date added to KEV | September 24, 2026 |
| Federal remediation deadline | September 27, 2026 |
| CVSS v3.1 score | 10.0 (under one scoring scenario) |
| Weakness classification | CWE-347, improper verification of cryptographic signature |
| Known ransomware use | Unknown, per CISA |
| Directive | Forensic triage required under BOD 26-04 |
Under BOD 26-04, federal agencies must apply the mitigations WSO2 recommends and follow the directive’s risk-based update guidance. CISA also tells stakeholders to assess how exposed each affected asset is to the internet and to meet any applicable cloud service requirements. Where no effective mitigation exists, agencies should stop using the product.
Why a KEV listing carries weight
CISA created the KEV catalog in 2021 under an earlier directive, BOD 22-01. The catalog is binding on federal civilian agencies. Many private-sector security teams also use it as a prioritization signal, because a listing means CISA has evidence of exploitation in the wild, not just a theoretical risk.
Which WSO2 Products Are Affected
According to CISA, CVE-2026-5430 affects four WSO2 products:
- WSO2 API Control Plane
- WSO2 API Manager
- WSO2 Traffic Manager
- WSO2 Universal Gateway
The initial reporting does not list specific affected version numbers. Administrators should check WSO2’s security advisory for CVE-2026-5430 to confirm whether their builds are affected and which fixes apply.
How the Vulnerability Works
Two descriptions, one CVE
Public descriptions of the flaw point in two directions, and defenders should take both seriously. CISA describes a path traversal issue that may allow unrestricted file uploads. That could lead to remote code execution on vulnerable systems.
The CVE record, by contrast, describes a weakness in JWT authentication. Affected products may accept tokens signed with algorithms that administrators never configured or supported. An attacker could craft a token with one of those algorithms, get it past improper validation, and gain unauthorized access. WSO2’s vendor record warns that exploitation can compromise administrative accounts and allow full account takeover.
The CWE-347 classification fits the JWT side of the problem. Still, the advisory covers both the authentication weakness and the file upload behavior, so organizations should evaluate each.
Background: why algorithm validation matters
A JSON Web Token includes a header that names the signing algorithm. Secure implementations enforce a fixed list of allowed algorithms on the server side. When a system trusts whatever algorithm the token itself declares, an attacker may be able to choose one that the verification logic handles poorly. This class of bug, often called algorithm confusion, has affected many JWT libraries and products over the years.
What a successful attack could achieve
Because WSO2 sits at the junction of API traffic and authentication, a breach there is a strong foothold. The advisory notes that attackers could steal sensitive data, tamper with API traffic, deploy malicious payloads, or move laterally into connected systems.
Response Steps for Security Teams
Start with inventory. Teams should find every internet-facing WSO2 instance and record its deployed version and role, whether that is control plane, gateway, or traffic manager. Exposure assessment is central to CISA’s guidance, and an unknown gateway cannot be patched.
Because of the forensic triage requirement, log review should happen alongside patching, not after it. Signs worth hunting for include unusual file uploads, suspicious JWT activity, administrator accounts no one remembers creating, and anomalous API gateway behavior.
If there is any chance of exposure, rotate potentially compromised credentials and review API access tokens. Systems should also be checked for web shells and unauthorized configuration changes, which can survive a patch. Throughout, follow the remediation instructions in WSO2’s security advisory for CVE-2026-5430.
