by Kastro
Paper/Archive/CVE-2026-71362

CVE-2026-71362

Adobe Adobe Commerce — Adobe Commerce | Incorrect Authorization (CWE-863)

KEV · due 27 SepEPSS 90%public exploitSSVC actCVSS 9.1
critical.is priorityof 100
97
CVSS 9.1 (CNA)9.1 / 10 × 3027.3In CISA KEV+3030.0EPSS percentile 99.8.998 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.

Affected

ProductAffectedFixed inSource
Adobe Commerce≤ 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-augCNA
Adobe Commerce B2B≤ 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-augCNA
Magento Open Source≤ 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-augCNA

Scores by source

adobe (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

advisoryhelpx.adobe.com/security/products/magento/apsb26-92.htmlrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-71362kevcisa.gov/known-exploited-vulnerabilities-catalog