{"metadata": {"vulnerability": "CVE-2026-5430", "count": 104, "kinds": {"milestone": 4, "sighting": 79, "kev": 11, "other": 10}}, "data": [{"timestamp": "2026-04-02T16:11:32.536Z", "date_only": false, "value": "2026-04-02T16:11:32.536Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-5430", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-06-30T02:45:20.842Z", "date_only": false, "value": "2026-06-30T02:45:20.842503Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mphych4fat27", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "357b3317-50c0-4279-82f2-485d3006f597", "content": "WSO2 patched seven flaws across API Manager and gateways, led by a CVSS 10 JWT auth bypass (CVE-2026-5430). Update WSO2 API Manager now.\n\n#WSO2 #APISecurity #CVE #AuthBypass #Cybersecurity #Infosec", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mphych4fat27"}, {"timestamp": "2026-08-06T07:33:28.156Z", "date_only": false, "value": "2026-08-06T07:33:28.156Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-5430", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-06T07:33:28.156Z", "date_only": false, "value": "2026-08-06T07:33:28.156Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / WSO2", "record": "CVE-2026-5430", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-06T08:16:33Z", "date_only": false, "value": "2026-08-06T08:16:33Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-J7VH-5W8Q-4M4X", "record": "GHSA-J7VH-5W8Q-4M4X", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-08-06T08:16:33.240Z", "date_only": false, "value": "2026-08-06T08:16:33.240", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-5430", "record": "FKIE_CVE-2026-5430", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-06T08:34:33.578Z", "date_only": false, "value": "2026-08-06T08:34:33.578188Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/gdxntzqkx3yrb", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "80690c57-5a9f-4882-ae35-fbc9be6e0a30", "content": "CVE-2026-5430 - Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover\nCVE ID : CVE-2026-5430\n \n Published : Aug. 6, 2026, 7:33 a.m. | 47\u00a0minutes ago\n \n Description : The JWT authentication mechanism accepts tokens signed with algori...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/gdxntzqkx3yrb"}, {"timestamp": "2026-08-06T09:00:30.800Z", "date_only": false, "value": "2026-08-06T09:00:30.800898Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117047743616861031", "record": "cve-2026-5430", "field": "creation_timestamp", "uuid": "87a0b1bf-6f7f-4c44-8c3e-af7732f2bba3", "content": "WSO2 Universal Gateway v4.5.0 & 4.6.0 affected by CRITICAL CVE-2026-5430 (CVSS 10.0). Improper JWT validation enables account takeover. No patch yet \u2014 apply compensating controls. https://radar.offseq.com/threat/cve-2026-5430-cwe-347-improper-validation-of-certificate-with-host-mismatch-in-wso2-wso2-universal-f913080655427dd8 #OffSeq #WSO2 #JWT #Vulnerability", "url": "https://infosec.exchange/users/offseq/statuses/117047743616861031"}, {"timestamp": "2026-08-06T09:00:33.688Z", "date_only": false, "value": "2026-08-06T09:00:33.688442Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3msfojgm2gi26", "record": "cve-2026-5430", "field": "creation_timestamp", "uuid": "31dad500-a395-49aa-85f6-56a77d9fe2b0", "content": "CRITICAL vuln: CVE-2026-5430 in WSO2 Universal Gateway (4.5.0/4.6.0) allows JWT auth bypass and full account takeover. No patch \u2014 restrict access & monitor logins. \ud83d\udd10 https://radar.offseq.com/threat/cve-2026-5430-cwe-347-improper-validation-of-certificate-with-host-mismatch-in-wso2-wso2-universal-...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3msfojgm2gi26"}, {"timestamp": "2026-08-06T09:04:06.494Z", "date_only": false, "value": "2026-08-06T09:04:06.494696Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msfopshjtl2s", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "da1382f4-c7e7-447d-a48b-123dd2dfc59b", "content": "CVE-2026-5430\nThe JWT authentication in [Software Name] can accept tokens signed with unknown algorithms, allowing attackers to gain unauthorized access to the system. This could lead to the compromise of administrative\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3msfopshjtl2s"}, {"timestamp": "2026-08-06T09:30:32Z", "date_only": false, "value": "2026-08-06T09:30:32Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-J7VH-5W8Q-4M4X", "record": "GHSA-J7VH-5W8Q-4M4X", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-06T12:15:04.860Z", "date_only": false, "value": "2026-08-06T12:15:04.860463Z", "kind": "sighting", "label": "Seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-5430", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "6929badb-9a39-436b-8c6f-1f5ccb222585", "url": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-5430"}, {"timestamp": "2026-08-07T13:05:34.871Z", "date_only": false, "value": "2026-08-07T13:05:34.871245Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3msimoieimb2n", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "fb15bb55-1c67-4ea1-9d63-bb0e3c65fe8b", "content": "WSO2 patched four critical account takeover flaws, including CVE-2026-5430 at CVSS 10 via JWT auth bypass. Details and fixes inside.\n\n#WSO2 #AccountTakeover #CVE #APIsecurity #CyberSecurity", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3msimoieimb2n"}, {"timestamp": "2026-08-11T02:07:06.921Z", "date_only": false, "value": "2026-08-11T02:07:06.921513Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3msrjqqnp7w2j", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "c6c0af01-a30b-4855-a821-2ec72f6dbd23", "content": "\ud83d\udccc CVE-2026-5430 - The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to... https://www.cyberhub.blog/cves/CVE-2026-5430", "url": "https://bsky.app/profile/cyberhub.blog/post/3msrjqqnp7w2j"}, {"timestamp": "2026-09-16T05:18:06Z", "date_only": false, "value": "2026-09-16T05:18:06+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-5430", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "f259b169-f7e7-4be8-9dae-1a7a384eba15", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-16T05:18:06Z", "date_only": false, "value": "2026-09-16T05:18:06.000Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2026-5430", "field": "evidence.0.details.added_date", "uuid": "f259b169-f7e7-4be8-9dae-1a7a384eba15", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-16T05:18:06Z", "date_only": false, "value": "2026-09-16T05:18:06+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2026-5430", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "f259b169-f7e7-4be8-9dae-1a7a384eba15", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-16T05:18:06Z", "date_only": false, "value": "2026-09-16T05:18:06+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2026-5430", "field": "status.status_updated_at", "uuid": "f259b169-f7e7-4be8-9dae-1a7a384eba15", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-16T07:10:04.860Z", "date_only": false, "value": "2026-09-16T07:10:04.860683Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmlhm4caz2n", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "ab61d562-0778-4e3a-8bf2-e7e86242106a", "content": "Patch WSO2 API Manager now \u2014 CVE-2026-5430 (CVSS 9.8) lets attackers forge admin JWTs for full account takeover. watchTowr reports active exploitation since 13 Sept. https://thehackernews.com/2026/09/active-exploitation-attempts-target.html", "url": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmlhm4caz2n"}, {"timestamp": "2026-09-16T08:02:29.847Z", "date_only": false, "value": "2026-09-16T08:02:29.847818Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/ichintu/267a83b424137af67bec5f39bcd35594", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "64a0d356-9a96-4d2b-b373-a6281718c42d", "content": "This daily threat intelligence digest highlights four critical security updates from September 2026:\n\n\u2022 **Arista EOS (CVE-2026-73447):** Critical (9.4) OS command injection in gNSI Certz/Bootz services allows authenticated users to escalate privileges and fully compromise devices.\n\u2022 **WSO2 API Manager (CVE-2026-5430):** Critical (9.8) JWT signature verification flaw enables forged admin tokens for account takeover; actively exploited in the wild.\n\u2022 **Oracle September 2026 CSPU:** Major patch release addressing 673 vulnerabilities, including several rated CVSS 10.0.\n\u2022 **VeloCloud Edge (CVE-2026-86108):** High (8.0) input validation weakness in management workflows can be abused for elevated OS command execution.\n\n**Recommendation:** Organizations should prioritize immediate patching and threat monitoring for these critical flaws to prevent privilege escalation, account compromise, and active exploitation.", "url": "https://gist.github.com/ichintu/267a83b424137af67bec5f39bcd35594"}, {"timestamp": "2026-09-16T08:29:47.391Z", "date_only": false, "value": "2026-09-16T08:29:47.391271Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvmpw6mheq2z", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "c7ffe78e-4c32-4ca8-b34b-15e891a37feb", "content": "\ud83e\udd16 CVE-2026-5430 (CVSS 9.8): critical JWT auth bypass in WSO2 API Manager actively exploited in the wild. Forged admin tokens allow full account takeover. Patch now.\nhttps://thehackernews.com/2026/09/active-exploitation-attempts-target.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mvmpw6mheq2z"}, {"timestamp": "2026-09-16T08:51:16.772Z", "date_only": false, "value": "2026-09-16T08:51:16.772716Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mvmr4lu2hk2p", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "a700d96c-a797-4e1c-a4ef-9441d18545b0", "content": "CVE-2026-5430 in WSO2 middleware is being exploited to bypass JWT authentication, enabling account takeover and access to API backends and credentials.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mvmr4lu2hk2p"}, {"timestamp": "2026-09-16T08:52:14.298Z", "date_only": false, "value": "2026-09-16T08:52:14.298485Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mvmr6cq3vx22", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "6b104104-c982-4e8c-a7ef-cc2374ce1e57", "content": "CVE-2026-5430 in WSO2 middleware is being exploited to bypass JWT authentication, enabling account takeover and access to API backends and credentials.\n", "url": "https://bsky.app/profile/privpros.bsky.social/post/3mvmr6cq3vx22"}, {"timestamp": "2026-09-16T08:52:26.547Z", "date_only": false, "value": "2026-09-16T08:52:26.547109Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mvmr6nmdtr2v", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "2a21f06c-125c-4fb2-85c4-d13358dba545", "content": "CVE-2026-5430 in WSO2 middleware is being exploited to bypass JWT authentication, enabling account takeover and access to API backends and credentials.\n", "url": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mvmr6nmdtr2v"}, {"timestamp": "2026-09-16T09:00:04.032Z", "date_only": false, "value": "2026-09-16T09:00:04.032868Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/thehackernews/10066", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "787fc4fc-8796-4aba-9709-fe2bfa9673e2", "content": "\u26a0\ufe0f Forged admin JWTs are being used in WSO2 API Manager exploitation attempts.\n\nCVE-2026-5430 lets unsupported JWT algorithms bypass authentication and can lead to account takeover. Fixes are available.\n\nRead: https://thehackernews.com/2026/09/active-exploitation-attempts-target.html", "url": "https://t.me/thehackernews/10066"}, {"timestamp": "2026-09-16T10:00:05.375Z", "date_only": false, "value": "2026-09-16T10:00:05.375373Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberDispatch/2964", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "3212ecd1-c43e-4ec7-94f2-4c5cfd5440ba", "content": "Forged admin JWTs are being used in WSO2 API Manager exploitation attempts.\n\nCVE-2026-5430 lets unsupported JWT algorithms bypass authentication and can lead to account takeover. Fixes are available.", "url": "https://t.me/CyberDispatch/2964"}, {"timestamp": "2026-09-16T10:00:45.367Z", "date_only": false, "value": "2026-09-16T10:00:45.367718Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2026/09/active-exploitation-attempts-target.html", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "98e1fbe5-1d16-43bc-90f8-974e942e936e", "content": "A critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr.\n\nThe vulnerability, tracked as CVE-2026-5430 (CVSS score: 9.8/10.0), is a case of improper verification of a cryptographic signature that could result in account takeover. Hacktron Team has been credited with discovering and reporting the flaw.\n\n\"JWT authentication", "url": "https://thehackernews.com/2026/09/active-exploitation-attempts-target.html"}, {"timestamp": "2026-09-16T10:00:45.526Z", "date_only": false, "value": "2026-09-16T10:00:45.526665Z", "kind": "sighting", "label": "Seen", "source": "https://www.securityweek.com/enterprises-warned-of-attacks-exploiting-wso2-vulnerability/", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "52531a01-0892-4f8b-9f56-5eab0529e2bc", "content": "The vulnerability, tracked as CVE-2026-5430, can be exploited to gain access to valuable enterprise data.\n\nThe post Enterprises Warned of Attacks Exploiting WSO2 Vulnerability appeared first on SecurityWeek.", "url": "https://www.securityweek.com/enterprises-warned-of-attacks-exploiting-wso2-vulnerability/"}, {"timestamp": "2026-09-16T11:22:28.143Z", "date_only": false, "value": "2026-09-16T11:22:28.143872Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mvmzkw6otj2r", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "7acc8523-f48f-433d-9f67-72b116488951", "content": "WSO2 API Manager \u306b\u3001\u7ba1\u7406\u8005\u30c8\u30fc\u30af\u30f3\u507d\u88c5\u306b\u3088\u308b JWT \u30d0\u30a4\u30d1\u30b9\u306e\u8106\u5f31\u6027 (CVE-2026-5430) \u304c\u767a\u898b\u3055\u308c\u3001\u6d3b\u767a\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u30a2\u30ab\u30a6\u30f3\u30c8\u4e57\u3063\u53d6\u308a\u306e\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002(\u2026", "url": "https://bsky.app/profile/postac001.bsky.social/post/3mvmzkw6otj2r"}, {"timestamp": "2026-09-16T13:59:15.474Z", "date_only": false, "value": "2026-09-16T13:59:15.474778Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cloud/statuses/117279777014363970", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "96e13109-4cda-459a-943b-a2be6d3fd6ec", "content": "\ud83e\udd16 CVE-2026-5430 (CVSS 9.8): critical JWT auth bypass in WSO2 API Manager under active exploitation. Attackers forge admin tokens via improper crypto signature verification, leading to full account takeover. Details by watchTowr.\ud83d\udd17 https://thehackernews.com/2026/09/active-exploitation-attempts-target.html#CVE #InfoSec #CyberSec", "url": "https://infosec.exchange/users/cloud/statuses/117279777014363970"}, {"timestamp": "2026-09-16T16:00:03.852Z", "date_only": false, "value": "2026-09-16T16:00:03.852808Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/ViralCyber/26273", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "1c114730-cf96-4241-9f1b-50b3fa314825", "content": "\ud83d\udd34\u062a\u0644\u0627\u0634\u200c\u0647\u0627\u06cc \u0641\u0639\u0627\u0644 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0646\u0642\u0635 \u062f\u0648\u0631 \u0632\u062f\u0646 JWT \u062f\u0631 WSO2 API Manager \u0628\u0627 \u062a\u0648\u06a9\u0646\u200c\u0647\u0627\u06cc \u062c\u0639\u0644\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc\n\n\u0634\u0631\u06a9\u062a \u0627\u0645\u0646\u06cc\u062a\u06cc watchTowr \u0627\u0632 \u062a\u0644\u0627\u0634\u200c\u0647\u0627\u06cc \u0641\u0639\u0627\u0644 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u062f\u0631 WSO2 API Manager \u0628\u0627 \u0634\u0646\u0627\u0633\u0647 CVE-2026-5430 (\u0627\u0645\u062a\u06cc\u0627\u0632 \u06f9.\u06f8) \u062e\u0628\u0631 \u062f\u0627\u062f\u0647 \u0627\u0633\u062a. \u0627\u06cc\u0646 \u0646\u0642\u0635\u060c \u0646\u0627\u0634\u06cc \u0627\u0632 \u0628\u0631\u0631\u0633\u06cc \u0646\u0627\u062f\u0631\u0633\u062a \u0627\u0645\u0636\u0627\u06cc \u0631\u0645\u0632\u0646\u06af\u0627\u0631\u06cc \u062f\u0631 \u0641\u0631\u0627\u06cc\u0646\u062f \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a JWT \u0627\u0633\u062a \u06a9\u0647 \u0628\u0647 \u062a\u0648\u06a9\u0646\u200c\u0647\u0627\u06cc \u0627\u0645\u0636\u0627\u0634\u062f\u0647 \u0628\u0627 \u0627\u0644\u06af\u0648\u0631\u06cc\u062a\u0645\u200c\u0647\u0627\u06cc \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc\u200c\u0646\u0634\u062f\u0647\u060c \u0627\u062c\u0627\u0632\u0647 \u0639\u0628\u0648\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f \u0648 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647 \u062a\u0635\u0627\u062d\u0628 \u06a9\u0627\u0645\u0644 \u062d\u0633\u0627\u0628 \u06a9\u0627\u0631\u0628\u0631\u06cc\u060c \u0627\u0632 \u062c\u0645\u0644\u0647 \u062d\u0633\u0627\u0628\u200c\u0647\u0627\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc\u060c \u0645\u0646\u062c\u0631 \u0634\u0648\u062f.\n\n\u0647\u0627\u0646\u06cc\u200c\u067e\u0627\u062a\u200c\u0647\u0627\u06cc watchTowr \u062f\u0631 \u062a\u0627\u0631\u06cc\u062e \u06f1\u06f3 \u0633\u067e\u062a\u0627\u0645\u0628\u0631\u060c \u062a\u0648\u06a9\u0646\u200c\u0647\u0627\u06cc JWT \u062c\u0639\u0644\u06cc \u062d\u0627\u0648\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0632 \u067e\u06cc\u0634 \u062a\u0639\u0628\u06cc\u0647\u200c\u0634\u062f\u0647 \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc \u0631\u0627 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f. \u0627\u06cc\u0646 \u0646\u0642\u0635\u060c \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u06f4.\u06f1.\u06f0 \u062a\u0627 \u06f4.\u06f6.\u06f0 \u0627\u0632 API Manager\u060c API Control Plane\u060c Traffic Manager \u0648 Universal Gateway \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f.\n\n\u0628\u0647 \u06af\u0641\u062a\u0647 \u06a9\u0627\u0631\u0634\u0646\u0627\u0633\u0627\u0646\u060c \u0627\u06cc\u0646 \u062a\u0648\u06a9\u0646\u200c\u0647\u0627\u06cc \u062c\u0639\u0644\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0628\u0631\u0627\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 \u062a\u0645\u0627\u0645 \u0646\u0642\u0627\u0637 \u067e\u0627\u06cc\u0627\u0646\u06cc \u0628\u06a9\u200c\u0627\u0646\u062f\u060c \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u0645\u0635\u0631\u0641\u200c\u06a9\u0646\u0646\u062f\u0647 \u0648 \u0627\u0633\u0631\u0627\u0631 \u062a\u0645\u0627\u0645 \u0627\u067e\u0644\u06cc\u06a9\u06cc\u0634\u0646\u200c\u0647\u0627\u06cc \u062b\u0628\u062a\u200c\u0634\u062f\u0647 \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u06cc\u0631\u0646\u062f \u0648 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u0627\u0645\u06a9\u0627\u0646 \u062d\u0631\u06a9\u062a \u062c\u0627\u0646\u0628\u06cc \u062f\u0631 \u0632\u06cc\u0631\u0633\u0627\u062e\u062a \u062f\u0627\u062e\u0644\u06cc \u0633\u0627\u0632\u0645\u0627\u0646 \u0631\u0627 \u0628\u062f\u0647\u0646\u062f.\n\n\n\u062c\u0647\u062a \u0645\u0637\u0627\u0644\u0639\u0647 \u06a9\u0627\u0645\u0644 \u062e\u0628\u0631 \u06a9\u0644\u06cc\u06a9 \u06a9\u0646\u06cc\u062f\n\n\ud83c\udd94 @TakianCo\n\ud83c\uddee\ud83c\uddf7", "url": "https://t.me/ViralCyber/26273", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-16T16:03:15.299Z", "date_only": false, "value": "2026-09-16T16:03:15.299603Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117281560448148242", "record": "cve-2026-5430", "field": "creation_timestamp", "uuid": "9cf94fce-84c4-40c8-baa3-b36aaa23b674", "content": "\ud83d\udcf0 Critical WSO2 API Flaw Under Active Attack, Exposes Enterprise Data\nCritical auth bypass (CVE-2026-5430, CVSS 10.0) in WSO2 API Manager is now actively exploited. Attackers can take over admin accounts. Patched in April 2026, ensure your systems are updated! #WSO2 #APISecurity #CyberAttack\n\ud83d\udd17 https://cyber.netsecops.io/articles/critical-wso2-api-vulnerability-cve-2026-5430-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/117281560448148242"}, {"timestamp": "2026-09-16T16:03:54.361Z", "date_only": false, "value": "2026-09-16T16:03:54.361331Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mvnjc6tadd2t", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "a29e519e-dd70-4193-9176-5b3c769a622a", "content": "Critical auth bypass (CVE-2026-5430, CVSS 10.0) in WSO2 API Manager is now actively exploited. Attackers can take over admin accounts. Patched in April 2026, ensure your systems are updated! #WSO2 #APISecurity #CyberAttack\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mvnjc6tadd2t"}, {"timestamp": "2026-09-16T21:30:03.120Z", "date_only": false, "value": "2026-09-16T21:30:03.120392Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mvo3jewp2k2d", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "526e3195-1b15-4d7e-9fbb-3fee8d3b21ed", "content": "Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens\n\nA critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr.\n\nThe vulnerability, tracked as CVE-2026-5430 (CVSS score: 9.\u2026\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mvo3jewp2k2d"}, {"timestamp": "2026-09-17T01:00:04.539Z", "date_only": false, "value": "2026-09-17T01:00:04.539372Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/10066", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "f4a0409c-8e5d-425e-81a8-5f4fdf0b316a", "content": "\u26a0\ufe0f Forged admin JWTs are being used in WSO2 API Manager exploitation attempts.\n\nCVE-2026-5430 lets unsupported JWT algorithms bypass authentication and can lead to account takeover. Fixes are available.\n\nRead: https://thehackernews.com/2026/09/active-exploitation-attempts-target.html", "url": "https://t.me/thehackernews/10066", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-17T06:00:01Z", "date_only": false, "value": "2026-09-17T06:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2026-5430", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "f259b169-f7e7-4be8-9dae-1a7a384eba15", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-17T06:01:19.506Z", "date_only": false, "value": "2026-09-17T06:01:19.506128Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f259b169-f7e7-4be8-9dae-1a7a384eba15", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "8cf17ed8-5a37-447c-ba2c-f6c25a30453e", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f259b169-f7e7-4be8-9dae-1a7a384eba15", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-17T11:00:04.435Z", "date_only": false, "value": "2026-09-17T11:00:04.435073Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/pphm_HackerNews/3181", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "cc55e27e-0e5e-4c93-b8bc-23c16a45410e", "content": "\ud83d\udd34 Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens\n\nA critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr.\n\nThe vulnerability, tracked as CVE-2026-5430 (CVSS score: 9.8/10.0), is a case of improper verification of a cryptographic signature that could result in account takeover. Hacktron Team has been credited with discovering and reporting the flaw.\n\n\"JWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access,\" according to an advisory released by WSO2 in May 2026. \"Successful exploitation of the vulnerability may lead to unauthorized access, including potential compromise of administrative accounts and full account takeover.\"", "url": "https://t.me/pphm_HackerNews/3181"}, {"timestamp": "2026-09-17T19:03:41.190Z", "date_only": false, "value": "2026-09-17T19:03:41.190828Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3mvqdsjz25s2f", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "74e9fbba-6ba9-479a-915b-47243b515f2d", "content": "WSO2 CVE-2026-5430: Authentication Bypass in API Management Infrastructure via JWT with Unsupported Algorithm dev.to/anoymask/wso...", "url": "https://bsky.app/profile/ytroncal.bsky.social/post/3mvqdsjz25s2f"}, {"timestamp": "2026-09-18T00:00:06.517Z", "date_only": false, "value": "2026-09-18T00:00:06.517106Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/pphm_HackerNews/3181", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "46d7ec69-c96f-4780-b0b8-4face4347545", "content": "\ud83d\udd34 Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens\n\nA critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr.\n\nThe vulnerability, tracked as CVE-2026-5430 (CVSS score: 9.8/10.0), is a case of improper verification of a cryptographic signature that could result in account takeover. Hacktron Team has been credited with discovering and reporting the flaw.\n\n\"JWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access,\" according to an advisory released by WSO2 in May 2026. \"Successful exploitation of the vulnerability may lead to unauthorized access, including potential compromise of administrative accounts and full account takeover.\"", "url": "https://t.me/pphm_HackerNews/3181", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-18T04:00:05.902Z", "date_only": false, "value": "2026-09-18T04:00:05.902764Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/dq3S5iEvkq3DxtfvQCt3KhtYaU_n-BFHDpC50159zutTbw", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "c66e2255-4fbe-43f5-bc72-529284abce55", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-18T04:00:09.892Z", "date_only": false, "value": "2026-09-18T04:00:09.892781Z", "kind": "sighting", "label": "Seen", "source": "Telegram/29Fa6kOu2Kkjlzr-wySBlSXFcHEZP-1nUpNSNRyD8H-deyE", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "4feea4b4-4fbd-4381-a37f-8655bec6fede"}, {"timestamp": "2026-09-19T00:00:23.943Z", "date_only": false, "value": "2026-09-19T00:00:23.943038Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/29Fa6kOu2Kkjlzr-wySBlSXFcHEZP-1nUpNSNRyD8H-deyE", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "f6c5e7e5-b9e0-4d41-b729-88e0eb9d0c29", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-24T00:00:00Z", "date_only": false, "value": "2026-09-24T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-5430", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "8f7cfd29-507e-4803-9548-bed3f0cfe455", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-24T00:00:00Z", "date_only": true, "value": "2026-09-24", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-5430", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-09-24T00:00:00Z", "date_only": true, "value": "2026-09-24", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2026-5430", "field": "evidence.0.details.date_added", "uuid": "8f7cfd29-507e-4803-9548-bed3f0cfe455", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-24T00:00:00Z", "date_only": false, "value": "2026-09-24T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2026-5430", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "8f7cfd29-507e-4803-9548-bed3f0cfe455", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-24T00:00:00Z", "date_only": false, "value": "2026-09-24T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-5430", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-24T00:00:00Z", "date_only": false, "value": "2026-09-24T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-5430", "record": "FKIE_CVE-2026-5430", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-24T00:00:00Z", "date_only": false, "value": "2026-09-24T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2026-5430", "field": "status.status_updated_at", "uuid": "8f7cfd29-507e-4803-9548-bed3f0cfe455", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-24T00:00:00Z", "date_only": false, "value": "2026-09-24T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-5430", "field": "containers.adp.0.timeline.0.time"}, {"timestamp": "2026-09-24T19:33:52.889Z", "date_only": false, "value": "2026-09-24T19:33:52.889379Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mwbyqzprjv25", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "a0ec7b33-55e5-41fd-a54e-b1e536faf4b0", "content": "\ud83d\uded1 CVE-2026-5430\nWSO2 Multiple Products\nCVSS 10.0 / EPSS 0% / KEV: No\nTL;DR: The JWT authentication mechanism accepts tokens signed with algorithms other than tho\u2026\nhttps://cvesentinel.com/report/CVE-2026-5430?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mwbyqzprjv25"}, {"timestamp": "2026-09-24T20:00:01Z", "date_only": false, "value": "2026-09-24T20:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2026-5430", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "8f7cfd29-507e-4803-9548-bed3f0cfe455", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-24T20:00:02.337Z", "date_only": false, "value": "2026-09-24T20:00:02.337118Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8f7cfd29-507e-4803-9548-bed3f0cfe455", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "f0c8275d-e935-4952-a5c1-46583daf2fd7", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8f7cfd29-507e-4803-9548-bed3f0cfe455", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-24T21:31:19Z", "date_only": false, "value": "2026-09-24T21:31:19Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-J7VH-5W8Q-4M4X", "record": "GHSA-J7VH-5W8Q-4M4X", "field": "modified"}, {"timestamp": "2026-09-25T02:46:34Z", "date_only": false, "value": "2026-09-25T02:46:34.000000Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2026/09/wso2-and-adobe-commerce-flaws-exploited.html", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "43db6f2e-b8f1-4786-826e-11763d588233", "content": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.\n\nThe vulnerabilities are listed below -\n\n\n  CVE-2026-5430 (CVS score: 9.8) - A path traversal vulnerability in  WSO2 API Control Plane,", "url": "https://thehackernews.com/2026/09/wso2-and-adobe-commerce-flaws-exploited.html"}, {"timestamp": "2026-09-25T03:55:16.285Z", "date_only": false, "value": "2026-09-25T03:55:16.285Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-5430", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-25T03:55:16.285Z", "date_only": false, "value": "2026-09-25T03:55:16.285Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-5430", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-25T05:06:58.758Z", "date_only": false, "value": "2026-09-25T05:06:58.758357Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/entorisec.bsky.social/post/3mwcyrsdmlq2e", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "ab9c0f0d-1add-41bd-acdf-7e18482236b9", "content": "CISA added CVE-2026-5430, a JWT auth bypass in WSO2 API Manager exploited since Sept 13 per watchTowr, and CVE-2026-71362, an Adobe Commerce/Magento auth flaw exploited since August per Sansec, to its KEV catalog today.", "url": "https://bsky.app/profile/entorisec.bsky.social/post/3mwcyrsdmlq2e"}, {"timestamp": "2026-09-25T06:30:19.912Z", "date_only": false, "value": "2026-09-25T06:30:19.912115Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mwd5guhoez2x", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "319c39d6-2791-4c89-9302-772eb71d5a51", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-5430: \u26a0\ufe0f CVE-2026-5430: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 0.4%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-5430-the-jwt-authentication-mechanism-accepts-tokens", "url": "https://bsky.app/profile/threatspotai.bsky.social/post/3mwd5guhoez2x"}, {"timestamp": "2026-09-25T08:00:24Z", "date_only": false, "value": "2026-09-25T08:00:24.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/ichintu/a425ebd263532d7f7c22e2d83104242b", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "089c8261-0238-47b4-b64c-ea707abfa8ef", "content": "On September 25, 2026, three high-severity vulnerabilities were reported: **CVE-2026-97818** (phpIPAM API authorization bypass, CVSS 8.6), **CVE-2026-97735** (ITFlow SVG file upload flaw, CVSS 8.0), and **CVE-2026-5430** (WSO2 path traversal, CVSS 9.8). CISA added the WSO2 and Adobe Commerce/Magento flaws to its Known Exploited Vulnerabilities (KEV) catalog due to confirmed active exploitation. Affected organizations should prioritize patching and apply immediate mitigations.", "url": "https://gist.github.com/ichintu/a425ebd263532d7f7c22e2d83104242b"}, {"timestamp": "2026-09-25T08:03:17.816Z", "date_only": false, "value": "2026-09-25T08:03:17.816773Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwdcn3sxh52a", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "8b739174-470d-40e1-a9e1-8a0d9e1f3531", "content": "\ud83e\udd16 CISA KEV: two flaws exploited in the wild. CVE-2026-5430 (CVSS 9.8) path traversal in WSO2 API Control Plane, plus an Adobe Commerce/Magento flaw. Patch exposed instances.\nhttps://thehackernews.com/2026/09/wso2-and-adobe-commerce-flaws-exploited.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mwdcn3sxh52a"}, {"timestamp": "2026-09-25T08:57:45Z", "date_only": false, "value": "2026-09-25T08:57:45.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/TDth3IpXKH6e1Q-59ElaBLQEA0J6sHsnnXUTIp0QQIzTww", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "75a389a7-55e9-4431-8713-26cc059e4a14", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-25T08:57:45Z", "date_only": false, "value": "2026-09-25T08:57:45.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/TDth3IpXKH6e1Q-59ElaBLQEA0J6sHsnnXUTIp0QQIzTww", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "f49fc21a-e230-4b2a-ac36-fd77942af2ff"}, {"timestamp": "2026-09-25T09:05:00.885Z", "date_only": false, "value": "2026-09-25T09:05:00.885737Z", "kind": "sighting", "label": "Seen", "source": "https://poliverso.org/objects/0477a01e-902dbb9a-d2bd1d0cae7745d0", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "89b88fcc-ef92-433f-bc82-4476dc520d84", "content": "U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: The first flaw added to the catalog, tracked as CVE-2026-5430 (CVSS score 10.0), is an authentication bypass in multiple WSO2 products [\u2026]U.S. CISA adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog", "url": "https://poliverso.org/objects/0477a01e-902dbb9a-d2bd1d0cae7745d0"}, {"timestamp": "2026-09-25T11:30:44Z", "date_only": false, "value": "2026-09-25T11:30:44.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/pphm_HackerNews/3301", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "68b3f1ba-5752-404f-97ff-430693839d13", "content": "\ud83d\udd34 WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.\n\nThe vulnerabilities are listed below -\n\nCVE-2026-5430 (CVS score: 9.8) - A path traversal vulnerability in WSO2 API Control Plane, API Manager, Traffic Manager and Universal Gateway that could allow unrestricted file upload and lead to remote code execution.\n\nCVE-2026-71362 (CVSS score: 9.1) - An incorrect authorization vulnerability in Adobe Commerce and Magento that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.", "url": "https://t.me/pphm_HackerNews/3301", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-25T12:53:05.517Z", "date_only": false, "value": "2026-09-25T12:53:05.517", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-5430", "record": "FKIE_CVE-2026-5430", "field": "lastModified"}, {"timestamp": "2026-09-25T13:00:46.853Z", "date_only": false, "value": "2026-09-25T13:00:46.853206Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mwdtazdv5p2s", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "74f26d1f-876c-4712-841a-1f128832cd21", "content": "(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2026-5430 \u2013 WSO2 Multiple Products Path Traversal\u00a0Vulnerability\n\nAnalyze the technical mechanics of CVE-2026-5430 with our WSO2 TSUITE brief, covering directory traversal vectors, unrestricted file uploads, and endpoint\u2026\n\nhttps://thecybermind.co/bg2r", "url": "https://bsky.app/profile/thecybermind.co/post/3mwdtazdv5p2s"}, {"timestamp": "2026-09-25T15:24:20Z", "date_only": false, "value": "2026-09-25T15:24:20.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.bleepingcomputer.com/news/security/cisa-warns-of-sharepoint-wso2-adobe-commerce-flaws-exploited-in-attacks/", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "acec0d5e-d51d-4913-af4f-1201295d96a0", "content": "The Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2. [...]", "url": "https://www.bleepingcomputer.com/news/security/cisa-warns-of-sharepoint-wso2-adobe-commerce-flaws-exploited-in-attacks/"}, {"timestamp": "2026-09-25T16:00:21.312Z", "date_only": false, "value": "2026-09-25T16:00:21.312177Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mwe5c3vhap2a", "record": "cve-2026-5430", "field": "creation_timestamp", "uuid": "ed43f396-4d5a-49c8-92d5-018d2dc67214", "content": "CISA KEV: CVE-2026-5430 (WSO2, CVSS 10.0) and CVE-2026-71362 (Adobe Commerce, CVSS 9.1) added 9/24. Federal\u2026 https://0daynews.com/articles/2026-09-25-wso2-adobe-commerce-cisa-kev-cve-2026-5430-cve-2026-71362/?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-3534", "url": "https://bsky.app/profile/0daynews.bsky.social/post/3mwe5c3vhap2a"}, {"timestamp": "2026-09-25T17:13:13.846Z", "date_only": false, "value": "2026-09-25T17:13:13.846126Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/AAKL/statuses/117332796561127193", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "685f3813-3052-40b9-a8ad-e55fc169a024", "content": "CISA has updated the catalogue.\n-  CVE-2026-65660: Microsoft SharePoint Code Injection Vulnerability https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=&field_date_added_wrapper=all&sort_by=field_date_added&items_per_page=20\n-  CVE-2026-67279: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-67279\nYesterday:\n- CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-71362\n-  CVE-2026-5430: WSO2 Multiple Products Path Traversal Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-5430 #CISA #infosec #vulnerability #Microsoft #Adobe", "url": "https://infosec.exchange/users/AAKL/statuses/117332796561127193"}, {"timestamp": "2026-09-25T17:24:40.379Z", "date_only": false, "value": "2026-09-25T17:24:40.379178Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bleepingcomputer.com/post/3mwebyvtmyb2j", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "48848095-e9f4-470f-8065-3f8278dbb0c4", "content": "The Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2.", "url": "https://bsky.app/profile/bleepingcomputer.com/post/3mwebyvtmyb2j"}, {"timestamp": "2026-09-25T18:18:23.653Z", "date_only": false, "value": "2026-09-25T18:18:23.653677Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mweeyxsbuf2v", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "f285ef9f-0780-401b-82f6-9bdde11a5086", "content": "\ud83e\udd16 CISA added two critical bugs to its KEV catalog: CVE-2026-5430, a WSO2 auth bypass, and CVE-2026-71362, an Adobe Commerce flaw \u2014 both actively exploited in the wild.\n\nhttps://www.bleepingcomputer.com/news/security/cisa-warns-of-sharepoint-wso2-adobe-commerce-flaws-exploited-in-attacks/", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mweeyxsbuf2v"}, {"timestamp": "2026-09-25T21:29:20.963Z", "date_only": false, "value": "2026-09-25T21:29:20.963622Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mwepofr5tp2c", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "ef12ea89-c456-4c8f-a5a9-70ffeb4c38c2", "content": "WSO2\u88fd\u54c1\u306e\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\u8106\u5f31\u6027(CVE-2026-5430)\u304c\u653b\u6483\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002CISA\u306fSharepoint\u3001Adobe Commerce\u3082\u5f71\u97ff\u3092\u53d7\u3051\u308b\u3068\u8b66\u544a\u3057\u3066\u3044\u307e\u3059\u3002", "url": "https://bsky.app/profile/postac001.bsky.social/post/3mwepofr5tp2c"}, {"timestamp": "2026-09-25T23:00:36Z", "date_only": false, "value": "2026-09-25T23:00:36.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/44600", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "65932396-f784-4462-b468-77143707ecce", "content": "CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks\n\nThe Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2. [...]\nhttps://www.bleepingcomputer.com/news/security/cisa-warns-of-sharepoint-wso2-adobe-commerce-flaws-exploited-in-attacks/", "url": "https://t.me/VulnerabilityNews/44600", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-26T05:55:56.711Z", "date_only": false, "value": "2026-09-26T05:55:56.711712Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mwflyc2jmw2n", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "eca6ae3c-dcad-4aa8-9605-5e2a5dacfd1c", "content": "\ud83d\udee1\ufe0f Failles exploit\u00e9es : Check Point SMS (CVE-2026-93616) et F5 BIG-IP (CVE-2026-94127) \u2014 CERT-FR ; CISA : SharePoint, WSO2 (CVE-2026-5430), Adobe Commerce.\nhttps://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1219/", "url": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mwflyc2jmw2n"}, {"timestamp": "2026-09-26T06:29:08.875Z", "date_only": false, "value": "2026-09-26T06:29:08.875813Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwfntnyhwa22", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "04b8a1b1-a06e-4f6c-b14b-bd2b2834e466", "content": "\ud83e\udd16 CISA KEV: CVE-2026-5430 (max sev), JWT auth bypass in WSO2 API Manager 4.1.0-4.6.0: forged tokens leak app credentials. Exploitation attempts seen. Fed deadline Sep 27.\nhttps://www.bleepingcomputer.com/news/security/cisa-warns-of-sharepoint-wso2-adobe-commerce-flaws-exploited-in-attacks/", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mwfntnyhwa22"}, {"timestamp": "2026-09-26T09:00:04Z", "date_only": false, "value": "2026-09-26T09:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/TaPHlkMPkhehRqnHe38AJBjJTNdGvP62G-J1A_H_uWxnXm0", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "474a6c47-a7ed-4b78-9633-d9f1a17b94b2", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-26T09:00:04Z", "date_only": false, "value": "2026-09-26T09:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/TaPHlkMPkhehRqnHe38AJBjJTNdGvP62G-J1A_H_uWxnXm0", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "bb1c3fcc-65de-4e7e-a34f-ea995104af77"}, {"timestamp": "2026-09-26T11:27:34.616Z", "date_only": false, "value": "2026-09-26T11:27:34.616019Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/calmnewzvibez.bsky.social/post/3mwg6jblk6625", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "56429694-b3ab-40bb-932c-150b34ec5034", "content": "WSO2 JWT Authentication Bypass: Analyzing the CVE-2026-5430 Critical Flaw\n\nExpert analysis of CVE-2026-5430, a critical authentication bypass in WSO2 products. Explore the technical root cause, active exploitation, and CISA remediation\n\n#CISA #WSO2\n\nRead more \u2192", "url": "https://bsky.app/profile/calmnewzvibez.bsky.social/post/3mwg6jblk6625"}, {"timestamp": "2026-09-27T00:00:00Z", "date_only": true, "value": "2026-09-27", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2026-5430", "field": "evidence.0.details.due_date", "uuid": "8f7cfd29-507e-4803-9548-bed3f0cfe455", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-27T01:13:21.787Z", "date_only": false, "value": "2026-09-27T01:13:21.787359Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwhmnvkip22d", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "6a8e4fde-19d3-4337-968b-f068159153b8", "content": "CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks\n\nThe Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise softw\u2026\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwhmnvkip22d"}, {"timestamp": "2026-09-27T09:40:05Z", "date_only": false, "value": "2026-09-27T09:40:05.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/BleepingComputer/25654", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "73c31b04-3370-49e1-8fd4-12d99873c39d", "content": "\u200aCISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks\n\nThe Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2. [...]\n\nhttps://www.bleepingcomputer.com/news/security/cisa-warns-of-sharepoint-wso2-adobe-commerce-flaws-exploited-in-attacks/", "url": "https://t.me/BleepingComputer/25654", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-27T09:40:05Z", "date_only": false, "value": "2026-09-27T09:40:05.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/BleepingComputer/25654", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "44a592d7-b8a6-415b-b647-2054cbfc322d", "content": "\u200aCISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks\n\nThe Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2. [...]\n\nhttps://www.bleepingcomputer.com/news/security/cisa-warns-of-sharepoint-wso2-adobe-commerce-flaws-exploited-in-attacks/", "url": "https://t.me/BleepingComputer/25654"}, {"timestamp": "2026-09-28T19:54:03Z", "date_only": false, "value": "2026-09-28T19:54:03.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/baseleeak/404", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "9781cdfc-94ac-4d8e-a541-4dc59ed3c1c4", "content": "4 Vulnerabilities Already Under Attack: CISA Adds SharePoint, WSO2, MikroTik, and Adobe Commerce to Catalog\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities to its catalog of flaws known to be exploited in the wild. The security gaps affect Microsoft SharePoint servers, WSO2 API management products, Adobe Commerce and Magento e-commerce stores, and devices running MikroTik RouterOS. For some of these vulnerabilities, attackers require no credentials or user interaction to succeed.\nThe most critical flaw, CVE-2026-5430, affects WSO2 API Manager versions 4.1.0\u20134.6.0, as well as API Control Plane, Traffic Manager, and Universal Gateway versions 4.5.0 and 4.6.0. WSO2 assigned the vulnerability a maximum CVSS score of 10 for certain configurations, warning that a successful attack allows for full account takeover, including administrative access.\nThe flaw stems from the validation process of JSON Web Tokens (JWT), which act as digital passes between applications and services. WSO2 accepted tokens signed with an unsupported algorithm, allowing malicious actors to forge tokens and bypass authentication. The vendor released patches in the spring and recommends installing the relevant updates or upgrading to an unaffected version.\nThe second critical vulnerability, CVE-2026-71362 (CVSS score: 9.1), impacts Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. An authorization bypass flaw allows unauthenticated attackers to gain access to customer accounts. Experts at Sansec, who analyzed the patch, discovered that the system incorrectly handled user identity within a session, enabling an attacker to switch the session to another client and access their profile and personal data.\nAdobe addressed CVE-2026-71362 in its August update (APSB26-92). At the time of the advisory's release, the company stated it had no evidence of active exploitation. However, Sansec claimed its security systems had already blocked attempts to exploit CVE-2026-71362. Its inclusion in the CISA catalog now confirms that active exploitation has moved beyond lab proof-of-concepts.\nMicrosoft SharePoint is being targeted via CVE-2026-65660 (CVSS score: 8.8). The flaw allows a low-privileged user to inject and execute code on the server over the network. Microsoft patched the vulnerability in August for SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Unlike the flaws in WSO2 and Adobe Commerce, exploiting CVE-2026-65660 requires a valid user account.\nThe fourth vulnerability, CVE-2026-67279, is located in the SSH server of MikroTik RouterOS. Under a specific sequence of actions, RouterOS began processing commands before the user authentication process was fully completed. As a result, an unauthenticated remote client could create, modify, and restore files within the accessible RouterOS directory, including configuration files and diagnostic data. Researchers described the issue after analyzing the September updates.\nMikroTik resolved the related flaws in RouterOS versions 6.49.21, 7.23.4, 7.24.2, and 7.25 beta 3. The company advises against leaving SSH exposed to untrusted networks. Following the update, administrators should inspect devices for unknown users, scripts, or other configuration changes. RouterOS may also label a device as \"Flagged\" if it detects known indicators of compromise.\nCISA has not disclosed who is exploiting these four vulnerabilities or which organizations are being targeted. U.S. federal agencies are required to remediate CVE-2026-5430 and CVE-2026-71362 by September 27, and CVE-2026-65660 and CVE-2026-67279 by September 28. For other organizations, inclusion in the CISA catalog serves as a high-priority alert that updates must be deployed immediately given the confirmed active exploitation, and internet-facing systems should be checked for signs of breach.\n\n____", "url": "https://t.me/baseleeak/404", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-28T19:54:03Z", "date_only": false, "value": "2026-09-28T19:54:03.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/baseleeak/404", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "816e9fc5-26cc-4592-b944-6773efd02f9d", "content": "4 Vulnerabilities Already Under Attack: CISA Adds SharePoint, WSO2, MikroTik, and Adobe Commerce to Catalog\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities to its catalog of flaws known to be exploited in the wild. The security gaps affect Microsoft SharePoint servers, WSO2 API management products, Adobe Commerce and Magento e-commerce stores, and devices running MikroTik RouterOS. For some of these vulnerabilities, attackers require no credentials or user interaction to succeed.\nThe most critical flaw, CVE-2026-5430, affects WSO2 API Manager versions 4.1.0\u20134.6.0, as well as API Control Plane, Traffic Manager, and Universal Gateway versions 4.5.0 and 4.6.0. WSO2 assigned the vulnerability a maximum CVSS score of 10 for certain configurations, warning that a successful attack allows for full account takeover, including administrative access.\nThe flaw stems from the validation process of JSON Web Tokens (JWT), which act as digital passes between applications and services. WSO2 accepted tokens signed with an unsupported algorithm, allowing malicious actors to forge tokens and bypass authentication. The vendor released patches in the spring and recommends installing the relevant updates or upgrading to an unaffected version.\nThe second critical vulnerability, CVE-2026-71362 (CVSS score: 9.1), impacts Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. An authorization bypass flaw allows unauthenticated attackers to gain access to customer accounts. Experts at Sansec, who analyzed the patch, discovered that the system incorrectly handled user identity within a session, enabling an attacker to switch the session to another client and access their profile and personal data.\nAdobe addressed CVE-2026-71362 in its August update (APSB26-92). At the time of the advisory's release, the company stated it had no evidence of active exploitation. However, Sansec claimed its security systems had already blocked attempts to exploit CVE-2026-71362. Its inclusion in the CISA catalog now confirms that active exploitation has moved beyond lab proof-of-concepts.\nMicrosoft SharePoint is being targeted via CVE-2026-65660 (CVSS score: 8.8). The flaw allows a low-privileged user to inject and execute code on the server over the network. Microsoft patched the vulnerability in August for SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Unlike the flaws in WSO2 and Adobe Commerce, exploiting CVE-2026-65660 requires a valid user account.\nThe fourth vulnerability, CVE-2026-67279, is located in the SSH server of MikroTik RouterOS. Under a specific sequence of actions, RouterOS began processing commands before the user authentication process was fully completed. As a result, an unauthenticated remote client could create, modify, and restore files within the accessible RouterOS directory, including configuration files and diagnostic data. Researchers described the issue after analyzing the September updates.\nMikroTik resolved the related flaws in RouterOS versions 6.49.21, 7.23.4, 7.24.2, and 7.25 beta 3. The company advises against leaving SSH exposed to untrusted networks. Following the update, administrators should inspect devices for unknown users, scripts, or other configuration changes. RouterOS may also label a device as \"Flagged\" if it detects known indicators of compromise.\nCISA has not disclosed who is exploiting these four vulnerabilities or which organizations are being targeted. U.S. federal agencies are required to remediate CVE-2026-5430 and CVE-2026-71362 by September 27, and CVE-2026-65660 and CVE-2026-67279 by September 28. For other organizations, inclusion in the CISA catalog serves as a high-priority alert that updates must be deployed immediately given the confirmed active exploitation, and internet-facing systems should be checked for signs of breach.\n\n____", "url": "https://t.me/baseleeak/404"}, {"timestamp": "2026-09-29T06:41:41.488Z", "date_only": false, "value": "2026-09-29T06:41:41.488047Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mwn7wtvamv2t", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "6b235fe1-6704-4476-be38-cdc9e31d00d3", "content": "Another day, another glorious flaw as CVE-2026-5430 allows anyone with a forged token to casually crown themselves admin across WSO2 API Manager and Gateway control planes. Organizations relying on these gateways are the unlucky targets who handed over digital keys because basic ...\n\nRead full story", "url": "https://bsky.app/profile/cerberusit.bsky.social/post/3mwn7wtvamv2t"}, {"timestamp": "2026-10-02T07:25:14Z", "date_only": false, "value": "2026-10-02T07:25:14.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/cyberok_news/260", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "39779204-b2ee-46b0-9a34-4dd8755e5290", "content": "\ud83e\udde8 \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 WSO2 API Manager (CVE-2026-5430)\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0434\u0434\u0435\u043b\u0430\u0442\u044c JWT-\u0442\u043e\u043a\u0435\u043d \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0431\u0435\u0437 \u043b\u043e\u0433\u0438\u043d\u0430 \u0438 \u043f\u0430\u0440\u043e\u043b\u044f. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430, CISA \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0430 CVE-2026-5430 \u0432 KEV. \u0415\u0441\u043b\u0438 \u0443 \u0432\u0430\u0441 WSO2 API Manager 4.1\u20134.6 \u2014 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u0435\u0441\u044c \u0438\u043b\u0438 \u0438\u0437\u043e\u043b\u0438\u0440\u0443\u0439\u0442\u0435 \u043f\u043e\u0440\u0442 9443.\n\n\u2139\ufe0f \u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u043e\u0434\u0434\u0435\u043b\u044b\u0432\u0430\u0435\u0442 JWT-\u0442\u043e\u043a\u0435\u043d \u0438 \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 REST API WSO2 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430. \u0410\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f.\nJWTUtil.verifyTokenSignature() \u043e\u0442\u043a\u043b\u043e\u043d\u044f\u043b \u0442\u043e\u043a\u0435\u043d\u044b \u0441 \u043d\u0435\u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u043c\u0438 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u0430\u043c\u0438 (HS256 \u0432\u043c\u0435\u0441\u0442\u043e RS256/384/512), \u043d\u043e \u0432\u044b\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u043b \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435. OAuthAuthenticationInterceptor \u043b\u043e\u0432\u0438\u043b \u0435\u0433\u043e (catch \u2192 return) \u0438 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u043b \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0443.\nAlgorithm confusion \u2014 \u0441\u0435\u0440\u0432\u0435\u0440 \u043e\u0436\u0438\u0434\u0430\u0435\u0442 RSA-\u043f\u043e\u0434\u043f\u0438\u0441\u044c, \u043d\u043e \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 HMAC. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u043e\u0434\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0442\u043e\u043a\u0435\u043d \u0441\u0432\u043e\u0438\u043c \u043a\u043b\u044e\u0447\u043e\u043c, \u0441\u0435\u0440\u0432\u0435\u0440 \u043e\u0448\u0438\u0431\u043e\u0447\u043d\u043e \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442.\n\u0414\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e JWT \u0441:\n\u2022 alg: HS256\n\u2022 iss: https://localhost:9443/oauth2/token\n\u2022 \u0431\u0435\u0437 kid\n\u041f\u043e\u0434\u043f\u0438\u0441\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u0430\u044f, exp, scope, sub \u043d\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u044e\u0442\u0441\u044f.\n\n\u2757\ufe0f\u0423\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438\n\u2022 WSO2 API Manager 4.1.0\u20134.6.0\n\u2022 API Control Plane 4.5.0, 4.6.0\n\u2022 Traffic Manager 4.5.0, 4.6.0\n\u2022 Universal Gateway 4.5.0, 4.6.0\n\u2022 \u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442 management REST \u043d\u0430 \u043f\u043e\u0440\u0442\u0443 9443.\n\u2022 \u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0432\u0451\u0440\u043d\u0443\u0442\u044b\u0435 \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u0438 \u0432\u0441\u0435\u0445 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432. \u0412\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430\u043c \u043f\u043e\u0434\u043f\u0438\u0441\u043a\u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 WSO2 Updates.\n\n\u2757\ufe0f\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 (update level)\n\u2022 API Manager: 4.1.0 \u2192 update 257, 4.2.0 \u2192 197, 4.3.0 \u2192 108, 4.4.0 \u2192 72, 4.5.0 \u2192 57, 4.6.0 \u2192 21.\n\u2022 API Control Plane: 4.5.0 \u2192 58, 4.6.0 \u2192 22.\n\u2022 Traffic Manager: 4.5.0 \u2192 56, 4.6.0 \u2192 21.\n\u2022 Universal Gateway: 4.5.0 \u2192 57, 4.6.0 \u2192 21.\n\u2022 Community-\u0441\u0431\u043e\u0440\u043a\u0438: \ncarbon-apimgt PR 13752 / product-apim PR 14167.\n\n\ud83d\udd25 \u041c\u0435\u0442\u0440\u0438\u043a\u0438\n\u2022 CVSS: 10.0 (\u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439). \u0412 single-tenant \u2014 9.8.\n\u2022 UPS: 10, Urgent\n\u2022 RWDS: 5\n\n\u231b\ufe0f \u0425\u0440\u043e\u043d\u043e\u043b\u043e\u0433\u0438\u044f\n\u2022 12.04.2026 \u2014 \u0444\u0438\u043a\u0441 \u0432 carbon-apimgt (PR 13752)\n\u2022 03.05.2026 \u2014 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c WSO2-2026-5328\n\u2022 06.08.2026 \u2014 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u043a\u0430\u0440\u0442\u043e\u0447\u043a\u0438 NVD CVE-2026-5430.\n\u2022 24.09.2026 \u2014 CISA \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0430 \u0432 KEV, \u0441\u0440\u043e\u043a \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u2014 27.09.2026\n\u2022 25.09.2026 \u2014 Abraxas Labs \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u0442 disclosure-\u043f\u0430\u043a \u0441 \u0440\u0430\u0431\u043e\u0447\u0438\u043c PoC\n\n\ud83d\udee1 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435\n1. \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u0434\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0438\u043b\u0438 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0439 \u043d\u0435\u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438.\n2. \u0415\u0441\u043b\u0438 \u043d\u0435\u043b\u044c\u0437\u044f \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u2014 \u0438\u0437\u043e\u043b\u0438\u0440\u0443\u0439\u0442\u0435 \u043f\u043e\u0440\u0442 9443.\n3. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043b\u043e\u0433\u0438 \u043d\u0430 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a /api/am/admin/ \u0438 /api/am/publisher/ \u0441 JWT \u0431\u0435\u0437 kid.\n4. \u041f\u0440\u0438 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u2014 \u0441\u043c\u0435\u043d\u0438\u0442\u044c \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u043f\u0430\u0442\u0447 \u043d\u0435 \u043e\u0442\u0437\u044b\u0432\u0430\u0435\u0442 \u0443\u0436\u0435 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u0435\u0441\u0441\u0438\u0438.\n\u0412 KEV \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0430\u0437\u0432\u0430\u043d\u0430 \u00abPath Traversal\u00bb \u2014 \u044d\u0442\u043e \u043e\u0448\u0438\u0431\u043a\u0430 CISA. \u0421\u0443\u0442\u044c \u0432 \u043e\u0431\u0445\u043e\u0434\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 JWT.\n\n\ud83d\udd17 \u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438\n\u2022 \u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 Abraxas Labs + PoC\n\u2022 \u0411\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c WSO2-2026-5328\n\u2022 \u041a\u0430\u0440\u0442\u043e\u0447\u043a\u0430 CVE-2026-5430 \u0432 NVD\n\u2022 KEV CISA\n\u2022 #13752 \u2014 \u0424\u0438\u043a\u0441 carbon-apimgt PR 13752\n\u2022 #14167 \u2014 \u0424\u0438\u043a\u0441 product-apim PR 14167", "url": "https://t.me/cyberok_news/260", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-04T23:12:54.346Z", "date_only": false, "value": "2026-10-04T23:12:54.346407Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/csirts.com/post/3mx3jnupzup2l", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "f33ea68d-c9ce-4571-a015-5d0563104340", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-5430: WSO2 Multiple Products Path Traversal Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-5430", "url": "https://bsky.app/profile/csirts.com/post/3mx3jnupzup2l"}, {"timestamp": "2026-10-08T01:00:07Z", "date_only": false, "value": "2026-10-08T01:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/104604", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "5b1c56be-44c9-45d2-b684-359c5fd99dbf", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-5430-WSO2\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a davidvrns\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-08 00:43:34\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDetection PoC for CVE-2026-5430 \u2014 unauthenticated JWT algorithm bypass (CVSS 10.0) affecting WSO2 API Manager 4.1.0\u20134.6.0. Read-only assessment tool with patch confirmation and WAF detection. Authorized use only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/104604", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-08T01:00:07Z", "date_only": false, "value": "2026-10-08T01:00:07.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/104604", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "31685c0f-46d2-42d6-be66-89b7884281f6", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-5430-WSO2\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a davidvrns\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-08 00:43:34\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDetection PoC for CVE-2026-5430 \u2014 unauthenticated JWT algorithm bypass (CVSS 10.0) affecting WSO2 API Manager 4.1.0\u20134.6.0. Read-only assessment tool with patch confirmation and WAF detection. Authorized use only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/104604"}, {"timestamp": "2026-10-08T09:00:04Z", "date_only": false, "value": "2026-10-08T09:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/A1FkH_jjc5ZdmoIatY_p78h7OpS-SxVymbU2qFBc27UcyiE", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "0f8be98e-1b48-4ff3-b9ed-f5580b8aac97", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-08T21:00:04Z", "date_only": false, "value": "2026-10-08T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/hRHSAf3bOXL1t8aTCse-mTaLSNrW_REwFx5yQVn12_bx7bQ", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "8a2091ec-52af-4816-8294-78ac6abfd622", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-08T21:00:04Z", "date_only": false, "value": "2026-10-08T21:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/hRHSAf3bOXL1t8aTCse-mTaLSNrW_REwFx5yQVn12_bx7bQ", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "367fa085-5876-4faf-80ca-fd9982f82127"}, {"timestamp": "2026-10-14T07:00:15Z", "date_only": false, "value": "2026-10-14T07:00:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/QrkUTJGRsHYJCsgaQdU6tyVPpju6VK84GnZNrmuky5R3IFc", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "80f57f7d-eba8-439e-8e17-1478ce0986b4", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-14T07:00:15Z", "date_only": false, "value": "2026-10-14T07:00:15.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/QrkUTJGRsHYJCsgaQdU6tyVPpju6VK84GnZNrmuky5R3IFc", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "92013ee0-2596-4a5f-9aed-04914f30af00"}, {"timestamp": "2026-10-25T00:52:06.028Z", "date_only": false, "value": "2026-10-25T00:52:06.028968Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mynyjnjg7k2j", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "d9064fba-0524-48bb-9726-fd63cb4dbb3a", "content": "CISA Adds Two Known Exploited Vulnerabilities to Catalog\nRelease Date September 24, 2026\n\nCVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability\nCVE-2026-71362 Adobe Commerce and Magento Incorrect Authorization Vulnerability", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mynyjnjg7k2j"}, {"timestamp": "2026-10-25T01:01:43.210Z", "date_only": false, "value": "2026-10-25T01:01:43.210705Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mynz2rmi7k2j", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "b800c020-71f5-47b6-8c20-a1493db06633", "content": "WSO2\u3068Adobe Commerce\u306e\u8106\u5f31\u6027\u304c\u653b\u6483\u306b\u60aa\u7528\u3055\u308c\u3001CISA\u306eKEV\u306b\u8ffd\u52a0\u3055\u308c\u307e\u3057\u305f\u3002\n\n\u7c73\u56fd\u306e\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u6728\u66dc\u65e5\u3001WSO2\u3068Adobe Commerce\u304a\u3088\u3073Magento\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u308b2\u3064\u306e\u91cd\u5927\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4e0a\u306e\u6b20\u9665\u3092\u3001\u5b9f\u969b\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u8a3c\u62e0\u306b\u57fa\u3065\u304d\u3001\u65e2\u77e5\u306e\u60aa\u7528\u8106\u5f31\u6027\uff08KEV\uff09\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u305f\u3002\n\n\u8106\u5f31\u6027\u306f\u4ee5\u4e0b\u306e\u3068\u304a\u308a\u3067\u3059\u3002\n\nCVE-2026-5430 (CVS\u30b9\u30b3\u30a2: 9.8) - WSO2 API\u30b3\u30f3\u30c8\u30ed\u30fc\u30eb\u30d7\u30ec\u30fc\u30f3\u3001API\u30de\u30cd\u30fc\u30b8\u30e3\u30fc\u3001\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u30de\u30cd\u30fc\u30b8\u30e3\u30fc\u3001\u30e6\u30cb\u30d0\u30fc\u30b5\u30eb\u30b2\u30fc\u30c8\u30a6\u30a7\u30a4\u306b\u304a\u3051\u308b\u30d1\u30b9\u30c8\u30e9\u30d0...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mynz2rmi7k2j"}, {"timestamp": "2026-10-25T01:02:39.844Z", "date_only": false, "value": "2026-10-25T01:02:39.844106Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mynz4j7e222j", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "9cf10de9-74ee-4500-95b0-8c31ecc95878", "content": "\u7c73\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u304c\u3001Adobe\u3068WSO2\u306e\u8106\u5f31\u6027\u3092\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\n\n\u7c73\u56fd\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001 \u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\uff08KEV\uff09\u30ab\u30bf\u30ed\u30b0\u306b\u4ee5\u4e0b\u306e\u8106\u5f31\u6027 \u3092\u8ffd\u52a0\u3057\u307e\u3057\u305f\u3002\n\nCVE-2026-5430 WSO2 \u8907\u6570\u88fd\u54c1\u30d1\u30b9\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u8106\u5f31\u6027\nCVE-2026-71362 Adob\u200b\u200be Commerce\u304a\u3088\u3073Magento\u306e\u8a8d\u8a3c\u30a8\u30e9\u30fc\u306e\u8106\u5f31\u6027\n\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3055\u308c\u305f\u6700\u521d\u306e\u8106\u5f31\u6027\uff08CVE-2026-5430\u3001CVSS\u30b9\u30b3\u30a210.0\uff09\u306f\u3001JWT\u7f72\u540d\u306e\u691c\u8a3c\u304c\u4e0d\u9069\u5207\u3067\u3042\u308b\u3053...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mynz4j7e222j"}, {"timestamp": "2026-10-25T01:10:42.845Z", "date_only": false, "value": "2026-10-25T01:10:42.845807Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mynzku36u22j", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "c7ccfdd8-6e7e-4cee-8764-9c6284374c62", "content": "CISA\u304cWSO2\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u304c\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u3053\u3068\u3092\u6307\u6458\n\n\u7c73\u56fd\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001WSO2\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u308b\u91cd\u5927\u306a\u8106\u5f31\u6027\uff08CVE-2026-5430\uff09\u3092\u3001\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\uff08KEV\uff09\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u307e\u3057\u305f\u3002\n\nCISA\u306f\u3001\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u304c\u3053\u306e\u8106\u5f31\u6027\u3092\u7a4d\u6975\u7684\u306b\u60aa\u7528\u3057\u3066\u3044\u308b\u3068\u3044\u3046\u8a3c\u62e0\u3092\u53d7\u3051\u3066\u3001\u3053\u306e\u6c7a\u5b9a\u3092\u4e0b\u3057\u307e\u3057\u305f\u3002CISA\u306f2026\u5e749\u670824\u65e5\u306b\u3053\u306e\u8106\u5f31\u6027\u3092\u8ffd\u52a0\u3057\u3001\u5f71\u97ff\u3092\u53d7\u3051\u308b\u9023\u90a6\u653f\u5e9c\u6a5f\u95a2\u306b\u5bfe\u3057\u30019\u670827\u65e5\u307e\u3067\u306b\u4fee\u6b63\u3059\u308b\u3088\u3046\u671f\u9650\u3092\u8a2d\u5b9a\u3057\u307e\u3057\u305f\u3002\n\nCVE-2026-5430\u306f\u3001WSO2 API\u30b3\u30f3\u30c8\u30ed\u30fc\u30eb\u30d7\u30ec\u30fc\u30f3\u3001API\u30de\u30cd\u30fc\u30b8\u30e3\u30fc...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mynzku36u22j"}, {"timestamp": "2026-10-25T01:22:24.736Z", "date_only": false, "value": "2026-10-25T01:22:24.736430Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3myo27rnkfs2j", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "ae312198-3bf1-4443-9844-7630c6602390", "content": "CISA\u306f\u3001SharePoint\u3001WSO2\u3001Adobe Commerce\u306e\u8106\u5f31\u6027\u304c\u653b\u6483\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u3068\u8b66\u544a\u3057\u305f\u3002\n\n\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001\u30cf\u30c3\u30ab\u30fc\u304c\u30a8\u30f3\u30bf\u30fc\u30d7\u30e9\u30a4\u30ba\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u30d7\u30ed\u30d0\u30a4\u30c0\u30fc\u3067\u3042\u308bWSO2\u306e\u8907\u6570\u306e\u88fd\u54c1\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u308b\u91cd\u5927\u306a\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\u306e\u8106\u5f31\u6027\uff08CVE-2026-5430\uff09\u3092\u60aa\u7528\u3057\u3066\u3044\u308b\u3068\u8b66\u544a\u3057\u3066\u3044\u308b\u3002\n\n\u540c\u6a5f\u95a2\u306f\u307e\u305f\u3001Adobe Commerce\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u308b\u5225\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027\u3067\u3042\u308bCVE-2026-71362\u3092\u3001\u653b\u6483\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u554f\u984c\u306e\u30ea\u30b9\u30c8\u306b\u8ffd\u52a0\u3057\u305f\u3002\n\n\u30cf\u30c3\u30ab\u30fc\u306f\u3001\u3055\u3089\u306b2\u3064\u306e\u8106\u5f31\u6027\u3082\u60aa\u7528\u3057\u3066\u3044\u308b\u30021\u3064\u306f\u3001...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3myo27rnkfs2j"}, {"timestamp": "2026-10-25T03:00:13Z", "date_only": false, "value": "2026-10-25T03:00:13.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/nTuGch3L7PA5-UJ2wpPVfVgjmMFZz-l_IPrrW9bOPr8E2Bc", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "0497ee2f-98e8-48fd-822f-187ab28e26f7", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-25T03:00:13Z", "date_only": false, "value": "2026-10-25T03:00:13.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/nTuGch3L7PA5-UJ2wpPVfVgjmMFZz-l_IPrrW9bOPr8E2Bc", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "da851c59-ad46-4295-befc-942528a392b4"}, {"timestamp": "2026-10-28T01:36:55.113Z", "date_only": false, "value": "2026-10-28T01:36:55.113699Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/planetbriefing.bsky.social/post/3myvmgkjpie2p", "record": "cve-2026-5430", "field": "creation_timestamp", "uuid": "cd45739d-bd70-425a-866a-35780f24d0b1", "content": "CVE-2026-5430: WSO2 Multiple Products Path Traversal Vulnerability\n\nThe source describes a path traversal flaw in multiple WSO2 products that could enable u\u2026\n\nhttps://planetbriefing.com/events/cve-2026-5430-wso2-multiple-products-path-traversal-vulnerability-4c087be8fd53\n\n#Technology #UnitedStates", "url": "https://bsky.app/profile/planetbriefing.bsky.social/post/3myvmgkjpie2p"}], "metrics": {"as_of": "2026-11-01T10:39:24.549Z", "anchors": {"origin": {"timestamp": "2026-08-06T07:33:28.156Z", "date_only": false, "value": "2026-08-06T07:33:28.156Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-5430", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-08-06T07:33:28.156Z", "date_only": false, "value": "2026-08-06T07:33:28.156Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-5430", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-09-26T09:00:04Z", "date_only": false, "value": "2026-09-26T09:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/TaPHlkMPkhehRqnHe38AJBjJTNdGvP62G-J1A_H_uWxnXm0", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "474a6c47-a7ed-4b78-9633-d9f1a17b94b2", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2026-09-16T05:18:06Z", "date_only": false, "value": "2026-09-16T05:18:06+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-5430", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "f259b169-f7e7-4be8-9dae-1a7a384eba15", "status": {"status_reason": "confirmed", "exploited": true}}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 3534277.844, "hours": 981.7438455555556, "days": 40.905993564814814, "min_seconds": 3534277.844, "max_seconds": 3534277.844, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-06T07:33:28.156Z", "date_only": false, "value": "2026-08-06T07:33:28.156Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-5430", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-09-16T05:18:06Z", "date_only": false, "value": "2026-09-16T05:18:06+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-5430", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "f259b169-f7e7-4be8-9dae-1a7a384eba15", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit": {"available": true, "seconds": 3534277.844, "hours": 981.7438455555556, "days": 40.905993564814814, "min_seconds": 3534277.844, "max_seconds": 3534277.844, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-06T07:33:28.156Z", "date_only": false, "value": "2026-08-06T07:33:28.156Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-5430", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-09-16T05:18:06Z", "date_only": false, "value": "2026-09-16T05:18:06+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-5430", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "f259b169-f7e7-4be8-9dae-1a7a384eba15", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 4411595.844, "hours": 1225.44329, "days": 51.06013708333333, "min_seconds": 4411595.844, "max_seconds": 4411595.844, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-06T07:33:28.156Z", "date_only": false, "value": "2026-08-06T07:33:28.156Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-5430", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-09-26T09:00:04Z", "date_only": false, "value": "2026-09-26T09:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/TaPHlkMPkhehRqnHe38AJBjJTNdGvP62G-J1A_H_uWxnXm0", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "474a6c47-a7ed-4b78-9633-d9f1a17b94b2", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 7527956.393822, "hours": 2091.098998283889, "days": 87.12912492849537, "min_seconds": 7527956.393822, "max_seconds": 7527956.393822, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-06T07:33:28.156Z", "date_only": false, "value": "2026-08-06T07:33:28.156Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-5430", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-01T10:39:24.549Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 3993678.549822, "hours": 1109.3551527283332, "days": 46.22313136368055, "min_seconds": 3993678.549822, "max_seconds": 3993678.549822, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-16T05:18:06Z", "date_only": false, "value": "2026-09-16T05:18:06+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-5430", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "f259b169-f7e7-4be8-9dae-1a7a384eba15", "status": {"status_reason": "confirmed", "exploited": true}}, "end": {"timestamp": "2026-11-01T10:39:24.549Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": true, "seconds": 3116360.549822, "hours": 865.6557082838889, "days": 36.068987845162034, "min_seconds": 3116360.549822, "max_seconds": 3116360.549822, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-26T09:00:04Z", "date_only": false, "value": "2026-09-26T09:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/TaPHlkMPkhehRqnHe38AJBjJTNdGvP62G-J1A_H_uWxnXm0", "record": "CVE-2026-5430", "field": "creation_timestamp", "uuid": "474a6c47-a7ed-4b78-9633-d9f1a17b94b2", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-01T10:39:24.549Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}