On Thursday, the U. S. Cybersecurity and Infrastructure Security Agency added two actively exploited security flaws affecting WSO2 and Adobe Commerce platforms to its Known Exploited Vulnerabilities catalog. The vulnerabilities, identified as CVE-2024-25635 in WSO2 Identity Server and CVE-2024-34102 in Adobe Commerce and Magento, were included based on confirmed real-world attacks. CISA’s action follows evidence that threat actors are leveraging these weaknesses to compromise systems and gain unauthorized access. The agency urges all federal civilian agencies and private sector organizations to apply patches immediately to mitigate risk. Both vulnerabilities allow remote code execution under certain conditions, making them particularly dangerous if left unaddressed. Security teams are advised to prioritize updates as part of their vulnerability management routines.
Threat actors have been observed using the WSO2 flaw to bypass authentication mechanisms and execute arbitrary code on vulnerable servers. In the case of Adobe Commerce, attackers exploit a deserialization vulnerability to inject malicious payloads into online stores, potentially leading to data theft or full system takeover. These exploits have been seen in targeted campaigns against organizations with exposed internet-facing services. Security researchers note that the ease of exploitation increases the likelihood of widespread abuse. CISA’s inclusion in the KEV catalog reflects the maturity and active use of these exploits by adversaries. Organizations using affected versions are strongly encouraged to review their exposure and apply vendor-supplied patches without delay.
Federal agencies must remediate the vulnerabilities within the timeframe specified by CISA’s binding operational directive, while private entities are urged to follow the same timeline as a best practice. Administrators should verify whether their WSO2 Identity Server and Adobe Commerce installations are running versions prior to the patched releases. Applying updates, restricting network access to affected services, and monitoring for suspicious activity are critical immediate actions. CISA also recommends reviewing logs for signs of compromise, especially if systems were exposed before patching. Delaying remediation increases the risk of breach, data loss, and operational disruption. Proactive defense remains essential in countering evolving threats targeting widely used enterprise platforms.
What versions of WSO2 and Adobe Commerce are affected? The WSO2 Identity Server flaw impacts versions prior to 5.11.0, while the Adobe Commerce vulnerability affects versions before 2.4.7-p2, 2.4.6-p5, and 2.4.5-p8.
Is there a workaround if patching isn’t immediately possible? CISA advises isolating affected systems from untrusted networks and implementing strict access controls as temporary measures until patches can be applied.
How can organizations confirm if they’ve been compromised? Reviewing server logs for unusual authentication attempts, unexpected code execution, or unfamiliar admin activity may indicate exploitation, though forensic analysis is often needed for confirmation.