Vulnerabilities

Four critical vulnerabilities are being exploited right now, and all of them sit on systems that face the internet: an online store, an API gateway, a VPN gateway and a firewall management server. None of them needs a login to exploit. CISA added all four to its Known Exploited Vulnerabilities (KEV) catalog this week, and US federal agencies have until September 27 to fix the Adobe and WSO2 ones.

Below is each flaw, what attackers were seen doing with it, the fix, and where to look if you were exposed before patching.

Attackers got there before the KEV listing

The red bars in the timeline show the gap. Adobe Commerce was being exploited on September 4, three days before Adobe shipped a hotfix, and twenty days before CISA listed it. Check Point released its fixes on September 9, and attackers were using the flaw by September 12. WSO2 honeypots saw forged admin tokens on September 13, eleven days before the KEV listing.

A patch process that waits for a KEV listing, or for the next maintenance window, was a week or more late on every one of these. For anything that faces the internet, a critical fix needs to go out within days of release.

Adobe Commerce and Magento: StyleSmuggler

CVE-2026-75650, CVSS 10.0. Sansec, which found the attacks and named the flaw StyleSmuggler, reports that an unauthenticated attacker can inject PHP through Magento's template system. The payload rides inside a "Payment Transaction Failed Reminder" email that the store builds itself, and the code runs when the template is rendered.

What attackers did with it:

• Exploitation started on September 4, before any patch existed.
• Attackers dropped a Rust backdoor and a PHP web shell on compromised stores.
• The backdoor's command-and-control host was disguised as a Network Time Protocol (NTP) server.
• CrowdSec recorded 2,760 exploitation signals between September 9 and 13, peaking at 1,303 on September 11.

Fix: apply Adobe hotfix VULN-39341 from bulletin APSB26-146 to every Adobe Commerce, Adobe Commerce B2B and Magento Open Source instance, including staging copies that face the internet. Then check for compromise. Search your mail logs for "Payment Transaction Failed Reminder" emails nobody expected, list PHP files changed since the attacks began (find . -name '*.php' -newermt 2026-09-04 from the Magento root is a quick start), and look for outbound traffic to hosts posing as NTP servers that are not the time servers you actually use.

WSO2 API Manager: a forged admin token is enough

CVE-2026-5430, CVSS 10.0 (9.8 on single-tenant deployments). WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway accept a JSON Web Token (JWT) signed with an algorithm they do not support. Instead of rejecting the token, the check gives up early and lets it through. So an attacker can write their own token, give themselves the administrator role and walk into the API management plane.

watchTowr's honeypots caught forged tokens with administrator privileges arriving from September 13. Researchers who tested the flaw reached API backend destinations, stored credentials, and the consumer keys and secrets of registered applications.

Fix: apply WSO2's patch from advisory WSO2-2026-5328. Because the gateway holds keys for other systems, patching is not the end of it. If the gateway was exposed before you patched, rotate the consumer keys and secrets it stores and the backend credentials it uses, and review admin activity since early September.

This is the same kind of bug we look for in web application tests: a token check that fails open instead of failing closed.

Check Point: two flaws, gateway and management

Check Point confirmed attacks on two separate flaws.

CVE-2026-85102, CVSS 9.8, Security Gateway and Spark Firewall. When Site-to-Site VPN or Remote Access VPN is on, a malformed X.509 certificate sent during IKE negotiation leads to remote code execution with no login. Check Point shipped fixes on September 9. Attacks began on September 12, routed through VPN services and proxies to hide their origin.

Fix: install LivePatch Take 26 on R81.20, R82 or R82.10, or a fixed Jumbo Hotfix (R81.20 Take 166, R82 Take 126, R82.10 Take 44, R81.10 Take 190, or later). If you cannot update yet, turn off the VPN implied rules and write explicit rules that allow UDP 500 and 4500 only from your known VPN peers.

CVE-2026-93616, CVSS 9.8, management servers. A path traversal and file upload flaw in the management web service lets an unauthenticated attacker run scripts and load Java classes. It affects Security Management Server, Multi-Domain Security Management, Log Server, Multi-Domain Log Server and SmartEvent. Check Point says a small number of targeted customers were hit.

Fix: apply the security hotfix or a fixed Jumbo (R82.10 Take 45, R82 Take 127, R81.20 Take 170, R81.10 Take 192, or later). Restrict TCP 19009 to trusted addresses, and set Trusted Clients to your internal admin ranges instead of Any.

We flag management interfaces that can be reached from outside whenever we find them in a network test, and this flaw is a good example of why.

What to do today

1. Check whether you run any of these products. Compare your asset inventory with what can actually be reached from the internet; the two lists rarely match.
2. Patch the internet-facing instances first, using the fixes above.
3. If an instance was exposed and unpatched during its red bar in the timeline, treat it as compromised until you have checked: web shells on Magento, unexpected admin actions on WSO2, new scripts or accounts on Check Point management servers.
4. Rotate any secrets those systems held.
5. Agree a faster route for critical fixes on internet-facing systems, so the next one goes out in days.

Step 1 is where most teams get stuck, and it is where our attack surface management work starts. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

---

Sources: Sansec on StyleSmuggler, Adobe APSB26-146, CrowdSec, WSO2 advisory, SecurityWeek on WSO2, Check Point advisory, CISA KEV catalog.