Update: WSO2 API Manager vulnerability officially added to CISA’s KEV Catalog

“These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise,” CISA said.

CVE-2026-5430 was initially disclosed in July, with malicious activity first detected in a honeypot run by cyber security firm WatchTowr.

“Our Attacker Eye global honeypot network captured forged JWT tokens arriving on September 13 with an ample number of administrator privileges already baked in and ready to ruin someone’s day,” Yordan Ganchev, principal threat intelligence specialist at the company, told Cyber Daily at the time.

Now, Ganchev has said the KEV addition proves his assertion that “this wasn't merely a theoretical vulnerability or a critical severity score on paper”.

Now, according to Ganchev, “It was exploitable, and attackers were already acting on it.”

“It’s worth reiterating that WSO2 isn’t a niche target. Its technology is used by nearly 1,000 customers across banking, government, telecommunications, and logistics,” Ganchev said overnight.

VIEW ALL

“Organisations in these sectors can't afford to wait for exploitation to be formally confirmed. By the time a vulnerability reaches the KEV catalog, attackers already have days, or, in this instance, weeks, to act.

“We’re well beyond simply identifying and scoring more vulnerabilities. Organisations need real-time visibility into attacker behaviour and the ability to rapidly reproduce vulnerabilities to validate their exposure and protect affected systems before public confirmation catches up.”

WSO2’s customers include ING, Qantas, Hilton, and the US Department of Justice.