Vulnerabilities Enterprises Warned of Attacks Exploiting WSO2 Vulnerability The vulnerability, tracked as CVE-2026-5430, can be exploited to gain access to valuable enterprise data. By Eduard Kovacs | September 16, 2026 (4:39 AM ET) Flipboard Reddit Whatsapp Whatsapp Email A critical WSO2 vulnerability patched earlier this year is now being exploited in the wild by threat actors seeking access to sensitive enterprise data. WSO2 is an open source middleware platform that enables organizations to design, secure, integrate, and manage APIs, services, and identities across hybrid and multi-cloud environments. The platform has nearly 1,000 enterprise customers worldwide in sectors such as banking, government, telecom, and logistics. Thousands more have adopted it through open source deployments, OEMs, and partners. Exposure management firm WatchTowr warned on Tuesday that a vulnerability tracked as CVE-2026-5430, which WSO2 patched in April, is being exploited in malicious attacks. The flaw carries a maximum CVSS score of 10. According to a vendor advisory issued in May, it can let attackers bypass authentication and take over accounts. “JWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access,” WSO2 explained, adding, “Successful exploitation of the vulnerability may lead to unauthorized access, including potential compromise of administrative accounts and full account takeover.” Advertisement. Scroll to continue reading. The API Manager, API Control Plane, Traffic Manager, and Universal Gateway products are affected. Yordan Ganchev, principal threat intelligence specialist at WatchTowr, told SecurityWeek that the company’s honeypot network saw the first exploitation attempt on September 13. Ganchev explained that the attacker used a forged JWT token, which allowed WatchTowr researchers to determine the attacker’s goal. “The forged token yields access to every API backend endpoint and its credentials, consumer keys and secrets for every registered application,” Ganchev said. “The service is also by definition made to intercept API requests on their way to internal systems, which provides a great opportunity to tap and steal sensitive data in transit and interact with internal services through this ‘Lateral Movement-as-a-Service’ product.” Ganchev added, “We observed a single attacker targeting the wrong product, but when we replayed their payload on the real one, it worked. Our honeypots were fortunate to be mixed up, but the same may not be guaranteed about real victim systems.” The expert also noted that the CVE record for CVE-2026-5430 was published only in early August, and technical details still do not appear to be public. However, WatchTowr easily reproduced the vulnerability based on the vendor’s patch. “The only mystery here is what took everyone else so long,” Ganchev said. Related : $1 Million Sandbox Challenge Uncovers Linux Kernel Flaws Related : Apple Patches 200 Vulnerabilities With New iOS 27, macOS Golden Gate 27 Releases Related : Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs Microsoft AI Code of Conduct Sets Cyberattack Boundaries, Chain of Command, Safety Constraints Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation Telus Warns Customers of Account Breaches Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack Ukrainian Conti Ransomware Developer Sentenced to 4 Years in US Prison Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion Cybersecurity M&A Roundup: 33 Deals Announced in August 2026 Widened Scan Turns Up Fourth Rogue Claude Cyber Incident Latest News Oracle Patches 800+ Vulnerabilities in September 2026 Security Update Microsoft Commits to Sweeping AI Privacy Rules for Students. Will Other Tech Giants Follow? “We Think the Security Control Is Working” Is No Longer Good Enough $1 Million Sandbox Challenge Uncovers Linux Kernel Flaws Exein Secures $270M at $1.7B Valuation for Physical AI Security Texas Utility CenterPoint Energy Confirms Breach After Hacker Leaks Data Thai Broadband Provider Hacked via Fortinet Vulnerability OpenAI Investigates Report Linking AI Agents to RubyGems Attack Trending Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Virtual Event: Attack Surface Management Summit 2026 September 16, 2026 Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs. Register Webinar: Building Continuous Authorization at Scale September 23, 2026 Explore what it takes to operationalize continuous authorization at scale, including the technical, organizational, and cultural changes required. Register People on the Move Geoff Belknap has joined HubSpot as Chief Trust Officer. Zero Networks has named Yossi Dagan as Chief Financial Officer. Manifold has appointed Joe Sullivan to its Board of Directors. More People On The Move Expert Insights “We Think the Security Control Is Working” Is No Longer Good Enough Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar) This Key Will Self-Destruct: An Open Standard for Revocable API Keys Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. (Matt Honea) What the Hugging Face Incident Teaches Security Leaders About AI Agent Access Security teams must treat autonomous agents as highly privileged identities. (Etay Maor) The Future of AI-Driven Security Depends on Complete Data For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality. (Danelle Au) The MFA Identity Trap: When Authentication Creates a False Sense of Security Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop. (Torsten George) Flipboard Reddit Whatsapp Whatsapp Email