Cyber Threat Brief — September 25 2026

1. WSO2 JWT Unsupported-Algorithm Auth Bypass — CVE-2026-5430 (NEW CISA KEV)

TL;DR: CISA (2026-09-24) added CVE-2026-5430 to KEV (due 2026-09-27, forensic triage Yes). Vendor WSO2-2026-5328: JWT auth accepts tokens signed with unsupported algorithms → unauth access / admin takeover (CVSS 10.0 / 9.8 single-tenant). Affects API Manager 4.1.0–4.6.0, API Control Plane / Traffic Manager / Universal Gateway 4.5.0–4.6.0. watchTowr: forged-JWT probing since 2026-09-13 (honeypot mistarget; payload reproduced on real product → backend destinations + consumer keys/secrets). KEV shortDescription says path-traversal/upload→RCE — treat as catalog naming mismatch; hunt as JWT alg bypass.

What’s New:

• First KEV listing (2026.09.24 / 1723); ITW evidence predates catalog by ~11 days
• Forged JWT → API backend credential harvest + “Lateral Movement-as-a-Service” via gateway intercept (watchTowr)
• ~1,000 enterprise WSO2 customers (banking/gov/telecom/logistics) + OSS/OEM footprint

Actionable Intel

Artifact	Type	ATT&CK	Log Source	Action
CVE-2026-5430 / WSO2-2026-5328 on API Manager 4.1.0→UL≥257 / 4.2.0→≥197 / 4.3.0→≥108 / 4.4.0→≥72 / 4.5.0→≥57 / 4.6.0→≥21; API Control Plane 4.5.0→≥58 / 4.6.0→≥22; Traffic Manager 4.5.0→≥56 / 4.6.0→≥21; Universal Gateway 4.5.0→≥57 / 4.6.0→≥21; community: carbon-apimgt#13752 + product-apim#14167	Vulnerable API mgmt / KEV	T1190	WSO2 version / update-level inventory	Apply listed update levels or public fixes; restrict internet reach to Gateway/Manager; finish forensic triage by 2026-09-27
HTTP Authorization: Bearer JWTs with unexpected alg (unsupported / not in configured allow-list) accepted with 2xx on management or API auth paths	Exploit probe	T1190 / T1078	Access / API gateway / WSO2 audit	Alert accepted JWTs whose alg ∉ configured set; correlate with anonymous/unknown principals accessing admin or app-registration APIs
Sudden read of backend endpoint credentials, consumer keys/secrets, or admin app changes after anomalous JWT auth	Post-bypass impact	T1552 / T1078	WSO2 audit / IdP / app registry	If hit: rotate all exposed consumer secrets + backend creds; review registered applications; assume possible admin takeover

Detection

Source	Rule	Gap
Splunk ESCU	None — verified search for CVE-2026-5430 / WSO2 / JWT unsupported-alg	No WSO2 JWT analytic
Elastic	None — verified search	No WSO2 / CVE-2026-5430 rule
Sigma	None — verified search. Rejected Potentially Suspicious JWT Token Search Via CLI (eyJ0eX/eyJhbG via find/findstr) — credential dump on endpoint, not gateway JWT alg bypass	No emerging-threat rule for CVE-2026-5430

Hunt hint: (1) Inventory WSO2 API Manager/ACP/TM/UG update levels vs table. (2) Parse Bearer JWTs at edge for unexpected alg. (3) Diff app-registry / consumer-key creates since 2026-09-13. (4) Do not wait on KEV “path traversal” wording — vendor mechanism is JWT alg bypass.

Sources: CISA KEV alert 2026-09-24, WSO2-2026-5328, SecurityWeek / watchTowr, The Hacker News

---

2. Adobe Commerce / Magento Customer Session Identity Switch — CVE-2026-71362 (NEW CISA KEV)

TL;DR: CISA (2026-09-24) added CVE-2026-71362 (CVSS 9.1, APSB26-92) to KEV (due 2026-09-27, forensic triage Yes). Incorrect authorization: failed /customer/account/editPost stores attacker-controlled customer_form_data (incl. id) → later Edit::execute mass-assigns into session → session rebinds to any customer id (PII/orders/addresses/payment tokens). Affects Commerce/Magento through -2026-jul trains; fixed -2026-aug isolated patches (24Xp-2026-08-001-CE). Sansec blocked ITW at disclosure; Previdian honeypots since 2026-09-10 (AU/NL/SE); Nuclei CVE-2026-71362 + lab dinosn/cve-2026-71362-magento-lab.

What’s New:

• KEV confirms exploitation Adobe advisory still does not acknowledge
• Public Nuclei flow: create throwaway account → poison editPost with id= + wrong password → reload edit / customer/section/load as victim
• Distinct from StyleSmuggler CVE-2026-75650 (template RCE; covered Sep 08)

Actionable Intel

Artifact	Type	ATT&CK	Log Source	Action
CVE-2026-71362 on Adobe Commerce 2.4.4–2.4.9 -2026-jul, Magento Open Source 2.4.6–2.4.9 -2026-jul, B2B 1.3.3–1.5.3 -2026-jul (fix: matching -2026-aug isolated patches / 24Xp-2026-08-001-CE)	Vulnerable e-comm / KEV	T1190 / T1078	Magento version / patch registry	Apply APSB26-92 isolated patch after latest -p for branch; composer update alone will not pull it — use Magento patch registry
Sequence: POST /customer/account/createPost → POST /customer/account/editPost with form field id=<victim> + forced-fail (change_email=1 / wrong current_password) → GET /customer/account/edit or /customer/section/load?sections=customer returning different customer identity	Exploit chain	T1190 / T1078	Access / WAF / Magento	Alert editPost bodies containing mass-assigned id; hunt historical sequences since 2026-08-11; block at WAF
Nuclei template http/cves/2026/CVE-2026-71362.yaml (tags vkev,kev); lab github.com/dinosn/cve-2026-71362-magento-lab	Scanner / PoC	T1190	Threat intel / WAF	Expect scanner noise; treat successful identity flip (section/load firstname ≠ throwaway) as compromise — force password resets / invalidate sessions for touched customer ids

Detection

Source	Rule	Gap
Splunk ESCU	None — verified search for CVE-2026-71362 / Magento editPost / customer_form_data	No Magento session-switch analytic
Elastic	None — verified search	No CVE-2026-71362 / Magento customer-session rule
Sigma	None — verified search. No Magento/Adobe Commerce session rules in tree (StyleSmuggler-era coverage was template RCE CVE-2026-75650, not identity switch)	No emerging-threat rule for CVE-2026-71362

Hunt hint: (1) Confirm -2026-aug patch present via Magento patch registry. (2) Grep access logs for editPost + id= with auth failures. (3) Correlate create→editPost→section/load identity flips. (4) Rotate sessions / review orders for customers touched in exploit window.

Sources: CISA KEV alert 2026-09-24, Adobe APSB26-92, Sansec, The Hacker News, Previdian, Nuclei CVE-2026-71362

---

3. Fluent Bit out_forward Secure-Forward PONG Overflow — CVE-2026-61674 (public PoC)

TL;DR: GHSA-jrp8-r9hx-gf73 / securityonline (amplify 2026-09-23…24): CVE-2026-61674 (CVSS 9.2) stack buffer overflow in plugins/out_forward/forward.c secure_forward_pong — copies server-controlled PONG reason into 32-byte stack buffer without type/length checks. Attacker who controls or impersonates a Secure Forward destination (Shared_Key / Empty_Shared_Key) can RCE the agent (root common). Affected ≥0.11.0, <5.0.8; fixed 5.0.8 (PR #11945). --supervisor fork-respawn freezes ASLR/canary → reliable leakless RCE. No confirmed ITW / not on KEV. Fan-out risk: one bad aggregator → entire forwarding fleet.

What’s New:

• Public technical detail + working PoC class now circulating (CVE updated 2026-09-24)
• Logging-plane supply-chain: agents dial out to attacker-controlled forward endpoint on first flush
• Distinct from prior Linux kernel KEV cluster; high DE relevance for K8s/cloud telemetry fleets

Actionable Intel

Artifact	Type	ATT&CK	Log Source	Action
CVE-2026-61674 on Fluent Bit ≥0.11.0 and <5.0.8 using out_forward with Shared_Key or Empty_Shared_Key (fix: ≥5.0.8; GHSA-jrp8-r9hx-gf73; commit 45486556 / PR #11945)	Vulnerable telemetry agent	T1190 / T1059	Package / container image inventory (fluent-bit --version)	Upgrade all agents/DaemonSets to ≥5.0.8; rebuild images pinned below 5.0.8
Config: out_forward → untrusted Host/Port with shared-key auth; opt-in --supervisor	Exposure condition	T1190	fluent-bit.conf / Helm values	Until patched: pin forward destinations to allow-listed IPs; enforce TLS cert verify; disable supervisor if not required
Sudden Fluent Bit crash-loop / SIGSEGV on handshake then unexpected child shells from fluent-bit UID; outbound to non-inventory aggregators	Exploit behavior	T1059 / T1570	EDR / container runtime / conntrack	Hunt fluent-bit process anomalies + unexpected egress to forward ports; rotate any secrets the agent held

Detection

Source	Rule	Gap
Splunk ESCU	None — verified search for CVE-2026-61674 / Fluent Bit / secure_forward_pong / out_forward	No Fluent Bit analytic
Elastic	None — verified search. Rejected hostNetwork pod rules — unrelated K8s privilege class	No Fluent Bit PONG overflow rule
Sigma	None — verified search	No emerging-threat rule for CVE-2026-61674

Hunt hint: (1) fluent-bit --version / image digests across clusters — flag <5.0.8. (2) Audit out_forward Host allow-lists + TLS verify. (3) Watch crash-loops coinciding with new forward endpoints. (4) No ITW yet — patch before mass scanner adoption.

Sources: GHSA-jrp8-r9hx-gf73, v5.0.8 release, PR #11945, CVE.org CVE-2026-61674, securityonline amplify

---

Status Updates

• CVE-2026-94127 (F5 BIG-IP APM) / CVE-2026-93616 (Check Point Management) / CVE-2026-93952 (Arista VeloCloud) / CVE-2026-85102 (Check Point VPN/Spark): KEV due TODAY 2026-09-25 (forensic triage Yes) — finish Eng HF / Jumbo Takes / VCO ≥5.2.3.16|≥6.4.2.8 / sk1000117; hunt APM UserInfo triad, cpm.elg greps, vc-sysmond MD5 dc78e206eaeadec59fc5801fe4556bd0, Spark cert subjects CN=vpn|vpn-user|vpnuser,OU=users,O=global. Sep 23 · Sep 11 VPN
• CVE-2026-42016/CVE-2026-42018 (JFrog): KEV due TODAY 2026-09-25 — continue POST /access/api/v1/aws/token/ + token:anonymous hunts; Cloudflare emergency Managed Ruleset now Blocks Artifactory auth-bypass paths. Sep 12
• CVE-2026-7273 (Zyxel GS1900): KEV due was 2026-09-24 — confirm 2.90(*.2)C0 + Kapibala IoC hunt. Sep 22
• CVE-2026-87902 (WordPress) / CVE-2026-63077 (TeamCity) / CVE-2026-80521 (Ubuntu AF_UNIX): No material change — keep ≥7.1.2, TeamCity ≥2025.11.7/≥2026.1.3 + scan*/XStream hunts, Ubuntu container-host inventory. Cloudflare emergency WAF now Blocks WP 87902. Sep 24
• Chrome CVE-2026-87491: KEV due was 2026-09-23 — confirm Chromium ≥153.0.8010.36; keep UTA0565/CLEANGULP BlueMoon hunts. Sep 09 · Sep 11 · Sep 23
• Windows CVE-2026-81963 + CVE-2026-85880: KEV due was 2026-09-22 — confirm Sep 2026 LCU. Sep 09
• CVE-2026-32996 (Veeam) / CVE-2026-93485 (Comment2Shell): No material change — Agent 13.0.3.1220 + WP ≥7.1.1 (87902 still needs ≥7.1.2). Sep 22