Critical WSO2 API Manager Flaw Exploited, CISA Sets September 27 Deadline

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) officially added CVE-2026-5430 to its Known Exploited Vulnerabilities (KEV) catalog on September 24, with a federal remediation deadline of September 27. The flaw is a JSON Web Token (JWT) authentication bypass in WSO2 API Manager that carries a CVSS score of 10.0 for multi-tenant deployments. Although a patch has been available since April, active exploitation was only detected in mid-September—indicating a five-month gap that attackers exploited.

The weakness lies in token validation logic that does not enforce the signing algorithm according to configuration. When it receives a JWT signed with an unsupported algorithm, the validator accepts it anyway. An attacker can craft a token with the claim sub: admin and full API management scope, causing the gateway to treat it as a legitimate administrator token. No credentials are required. The Hacktron team discovered the flaw and disclosed it through advisory WSO2-2026-5328 on May 3, 2026. Affected versions include WSO2 API Manager 4.1.0 through 4.6.0, as well as the API Control Plane, Traffic Manager, and Universal Gateway components.

The watchTowr honeypot network first caught a fake admin JWT targeting this flaw on September 13, four months after the patch was released. The captured token was already fully formed with the claim sub: admin and complete API management scope values. According to Yordan Ganchev of watchTowr, the goal of the attack is to enumerate the API catalog and extract backend credentials, consumer keys, and secrets for every registered application. Security Affairs confirmed the CISA KEV addition, but no threat actor has been publicly attributed.

"The API gateway is the main entry point for AI agents accessing corporate data. Agents that call APIs through the WSO2 gateway trust that the gateway has authenticated the request. A CVSS 10.0 authentication bypass at the gateway level is a catastrophic failure for that trust model," said a security analyst who did not wish to be named.

The connection to this week's wave of deadlines is structural. Four CVEs in the CISA KEV—F5 BIG-IP APM (CVE-2026-94127), Check Point VPN (CVE-2026-85102), Check Point Management Server (CVE-2026-93616), and Arista VeloCloud (CVE-2026-93952)—all share the same federal deadline under BOD 26-04. WSO2 joins them with a September 27 deadline. The pattern is clear: BOD 26-04 compresses the patch window to 72 hours for actively exploited vulnerabilities, and the infrastructure layers that AI agents depend on are entering the catalog faster than teams can fix them.

For Indonesia, the impact cannot be ignored. WSO2 API Manager is widely used by telecommunications companies, banks, and digital public services to manage both internal and external APIs. If this flaw is exploited, attackers can access backend credentials, consumer keys, and secrets of registered applications—opening the way for customer data theft, API abuse, and service disruption. National cybersecurity authorities need to coordinate immediately with vendors and users to ensure patches are applied, especially at government agencies and critical infrastructure operators that are frequent targets.

Recommended mitigation steps include applying the vendor patch immediately. For the community edition, fixes are available through a PR on GitHub. For supported deployments, the update level is documented in the advisory. In addition, restrict network access to management and admin interfaces, and audit logs for JWTs accepted with header algorithms different from those configured. The five-month gap between patch and exploitation is the window attackers rely on. The question is, how much longer will organizations in Indonesia delay updates before this vulnerability is actually exploited?