CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks

Four serious vulnerabilities across widely-used enterprise platforms — including authentication bypasses, authorization flaws, and code injection — are being actively exploited in the wild, prompting CISA to add them to its Known Exploited Vulnerabilities catalog. The root cause pattern here is delayed or absent patch application on internet-facing and critical infrastructure systems, leaving known weaknesses open for attackers to abuse. Authentication bypass and incorrect authorization flaws are particularly dangerous because they can allow unauthenticated attackers to gain privileged access without needing stolen credentials. Federal agencies have been given hard deadlines to remediate, but private sector organizations face the same risk and should treat CISA KEV listings as urgent signals requiring immediate action.