Friday, September 25, 2026|Issue 7|6 min read|Join the discussion
Vulnerability management is reaching a scaling limit
Exploited vulnerabilities continue to pressure remediation queues while CISA pushes CVE quality forward and AI infrastructure collides with the realities of networking, power, capital and observability.
The short version
- CISA added WSO2 CVE-2026-5430 and Adobe Commerce/Magento CVE-2026-71362 to KEV on September 24; federal agencies have until Sunday, September 27.
- Today is the deadline for the F5 BIG-IP APM, two Check Point and Arista VeloCloud Orchestrator flaws CISA added on September 22.
- CISA published its CVE "Quality Era" framework, aimed at governance, participation, data infrastructure and record content.
- Akamai says Anthropic committed $11.6 billion over seven years to its distributed cloud, with room to grow to about $20 billion.
- Microsoft tied one ransomware affiliate, Storm-2570, to Qilin, DragonForce, Anubis and BERT deployments using the same pre-encryption playbook.
Issue at a glance
1 critical1 high2 notable
- criticalCloudWSO2 and Adobe Commerce flaws join KEV with a three-day fuse
- highPolicyToday is the federal deadline for the F5, Check Point and VeloCloud flaws
- notablePolicyCISA lays out its CVE "Quality Era" framework
- notableAIAnthropic commits $11.6 billion to Akamai's distributed cloud
Patch clock
| CVE | Product | What it is | Severity |
|---|---|---|---|
| CVE-2026-5430 | WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway | CISA lists it as a path traversal flaw; WSO2 and researchers describe forged admin JWTs accepted via an unsupported signing algorithm. Descriptions differ; check WSO2-2026-5328. | Actively exploited (KEV) |
| CVE-2026-71362 | Adobe Commerce and Magento Open Source | Incorrect authorization letting an attacker gain elevated access to sensitive resources without user interaction. | Actively exploited (KEV) |
Also on the vulnerability desk
- Due today, September 25: F5 BIG-IP APM CVE-2026-94127, Check Point CVE-2026-85102 and CVE-2026-93616, and Arista VeloCloud Orchestrator CVE-2026-93952, all added to KEV on September 22.
CISA — CISA Adds Four Known Exploited Vulnerabilities to Catalog|CISA — Known Exploited Vulnerabilities Catalog
- Both new entries carry "Forensic triage required per BOD-26-04: Yes," so agencies must look for pre-patch compromise, not just patch.
CISA — Known Exploited Vulnerabilities Catalog|CISA — BOD 26-04: Prioritizing security updates based on risk
CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog|CISA — Known Exploited Vulnerabilities Catalog
Breaking
KEV / API security / e-commerce
WSO2 and Adobe Commerce flaws join KEV with a three-day fuse
On September 24 CISA added WSO2 CVE-2026-5430 and Adobe Commerce/Magento CVE-2026-71362 to the KEV catalog based on evidence of active exploitation, with a September 27 due date. watchTowr reported exploitation attempts against WSO2 honeypots since at least September 13; Sansec said it blocked attempts against the Adobe flaw in August.
Why it matters. WSO2 API Manager sits in front of the APIs, tokens and gateways an organization exposes, so a flaw there hands an attacker the control plane for everything behind it. Sources describe the WSO2 bug differently: CISA calls it path traversal, while WSO2's advisory and several researchers describe a JWT signature bypass that yields admin access. The Adobe flaw lets attackers switch into other customers' sessions and reach their private data, per Sansec. Adobe had not updated its advisory to confirm exploitation as of The Hacker News report.
What to do. Apply the fixes in WSO2-2026-5328 and Adobe APSB26-92, or the vendor's mitigations if you cannot patch yet. Then review API Manager admin activity and recently issued tokens for anything you did not create, and check Commerce logs for unexpected customer session changes.
CVE-2026-5430, CVE-2026-71362
CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog|CISA — Known Exploited Vulnerabilities Catalog|WSO2 — Security Advisory WSO2-2026-5328|Adobe — Security bulletin APSB26-92|The Hacker News|Security Affairs
KEV / network infrastructure
Today is the federal deadline for the F5, Check Point and VeloCloud flaws
The four vulnerabilities CISA added on September 22 are due today: F5 BIG-IP APM CVE-2026-94127, Check Point CVE-2026-85102 and CVE-2026-93616, and Arista VeloCloud Orchestrator CVE-2026-93952. This is an update to a story we covered on September 23.
Why it matters. These products authenticate users, enforce firewall policy and manage SD-WAN fleets. Patching them closes the door, but it does not tell you whether someone walked through it first, and CISA marks all four as requiring forensic triage under BOD 26-04.
What to do. Confirm the fixes or vendor mitigations are applied everywhere, including standby and lab units. Then hunt: review admin accounts, configuration changes and new scripts on these devices since before the patch went in.
CVE-2026-94127, CVE-2026-85102, CVE-2026-93616, CVE-2026-93952
CISA — CISA Adds Four Known Exploited Vulnerabilities to Catalog|CISA — Known Exploited Vulnerabilities Catalog|F5 — K000162605|Arista — Security Advisory 0144|CISA — BOD 26-04: Prioritizing security updates based on risk
CISA / CVE / vulnerability management
CISA lays out its CVE "Quality Era" framework
CISA published CVE Program: Establishing a Quality Era Framework on September 22, describing how it will improve the program across four areas: governance, ecosystem participation, data infrastructure and CVE record content. Infosecurity Magazine, citing the paper, reported more than 67,000 CVEs published in 2026 as of September 18.
Why it matters. Scanners, ticketing rules and AI triage tools all read CVE records as ground truth. When records are incomplete or wrong, automated prioritization inherits the error at machine speed. CISA says AI-enabled tools are adding pressure across disclosure and triage.
What to do. Check where your tooling depends on CVE fields such as affected versions and product names, and note where you already correct them by hand. Those gaps are where better upstream data will help first.
CISA — CVE Program: Establishing a Quality Era Framework|CISA — Whitepaper charts path to maturing CVE Program quality|Infosecurity Magazine
AI infrastructure / cloud
Anthropic commits $11.6 billion to Akamai's distributed cloud
Akamai announced on September 24 that Anthropic has committed $11.6 billion over seven years to support its growing CPU workloads on Akamai Cloud, with a possible expansion of up to $9 billion more. Akamai also issued Anthropic a warrant for up to about 5% of its stock, tied to the relationship's growth.
Why it matters. Akamai's pitch is a distributed network footprint rather than a few giant regions. The deal suggests AI providers want capacity spread closer to users, not just more GPUs. It does not by itself tell us what workloads will run where.
What to do. No action needed. If you rely on Anthropic models, watch for changes in the regions or providers listed in its data processing terms.
Akamai — $11.6 billion multi-year agreement with Anthropic|Reuters via CNA
Trends
Vulnerability management is becoming a data problem
The old loop was scan, sort by CVSS, open a ticket, patch. This week shows why it is straining: two new KEV entries on top of four due today, and CISA openly saying CVE volume and quality need work. The loop that holds up is discover, correlate, add context such as exposure, attack path and what authority the asset holds, prioritize, remediate, verify, then hunt. BOD 26-04 already points that way, asking agencies to focus on exploited flaws on exposed assets and to check for compromise. Knowing a vulnerability exists is getting cheap. Knowing whether it matters in your environment is the valuable part.
CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog|CISA — BOD 26-04: Prioritizing security updates based on risk|CISA — Whitepaper charts path to maturing CVE Program quality
AI observability is becoming its own discipline
AWS made Amazon CloudWatch Omni generally available, putting AI agent traces and quality evaluations beside ordinary application telemetry. AWS says it scores agent responses for things like correctness and tool selection, because an agent can return a well-formed answer that is wrong without raising an error. For defenders, the same traces are the record of what an agent decided and which tools it called, which is what you need when asking what an agent did with its access.
AWS — Amazon CloudWatch Omni general availability|AWS News Blog — Introducing Amazon CloudWatch Omni
AI infrastructure keeps running into physical limits
Oracle sent a force majeure notice to a Blue Owl unit developing Project Jupiter, the Stargate data center campus in New Mexico, citing possible delays in securing power, according to Bloomberg and Reuters. Oracle says the project remains on schedule. TechCrunch reports the site's gas pipeline has been pushed to February 2027 after permit denials. Alongside Akamai's disclosed capital spending for its Anthropic deal, it is a reminder that power, permits and financing now pace AI capacity as much as chips do.
Reuters via BNN Bloomberg|TechCrunch|Akamai — $11.6 billion multi-year agreement with Anthropic
Ransomware brands change; the affiliate's playbook does not
Microsoft Threat Intelligence tied Storm-2570, an affiliate it has tracked since April 2025, to deployments of Qilin, DragonForce, Anubis and BERT ransomware. Across cases it saw the same remote access tools, credential theft, lateral movement, security tampering and cloud exfiltration before encryption. Microsoft has not determined how the group gets in. The lesson is to detect the behavior, such as an unexpected MeshAgent or other remote management tool, rather than wait for a ransom note to name the brand.
Clearance corner
BOD 26-04 and CVE quality point the same direction
Both new KEV entries carry a three-day federal deadline and a forensic triage requirement under BOD 26-04, so agency teams need to document compromise checks, not only patch dates. CISA's CVE Quality Era framework is the upstream half of the same effort: federal risk-based remediation depends on CVE records being accurate enough to automate against. For ISSOs, this is a good week to confirm your continuous monitoring evidence shows both.
CISA — BOD 26-04: Prioritizing security updates based on risk|CISA — Known Exploited Vulnerabilities Catalog|CISA — CVE Program: Establishing a Quality Era Framework
What we are watching next
Sunday's KEV deadline
WSO2 CVE-2026-5430 and Adobe CVE-2026-71362 are due September 27; watch whether Adobe confirms exploitation in its advisory.
Post-deadline activity on F5, Check Point and VeloCloud
Look for new indicators or reports of compromise found during forensic triage after today's deadline.
CVE modernization
Whether CISA follows the framework with concrete record-content requirements for CVE Numbering Authorities.
Akamai and Anthropic buildout
Where the new capacity comes online and whether the extra $9 billion option is exercised.
Power and financing for AI data centers
Whether Project Jupiter's force majeure notice leads to an actual delay past its 2028 target.
Sources
- CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog
- CISA — Known Exploited Vulnerabilities Catalog
- CISA — CISA Adds Four Known Exploited Vulnerabilities to Catalog
- CISA — BOD 26-04: Prioritizing security updates based on risk
- WSO2 — Security Advisory WSO2-2026-5328
- Adobe — Security bulletin APSB26-92
- The Hacker News
- Security Affairs
- F5 — K000162605
- Arista — Security Advisory 0144
- CISA — CVE Program: Establishing a Quality Era Framework
- CISA — Whitepaper charts path to maturing CVE Program quality
- Infosecurity Magazine
- Akamai — $11.6 billion multi-year agreement with Anthropic
- Reuters via CNA
- AWS — Amazon CloudWatch Omni general availability
- AWS News Blog — Introducing Amazon CloudWatch Omni
- Reuters via BNN Bloomberg
- TechCrunch
- Microsoft Threat Intelligence — Tracking Storm-2570
Join the discussion
Loading comments…