Adobe Commerce: Incorrect authorization leads to privilege escalation
Deadline for US federal agencies: 27 Sep 2026
Summary
Adobe Commerce, Magento Open Source and Adobe Commerce B2B are affected by an incorrect authorization flaw (CWE-863). According to third-party analyses, an unauthenticated attacker can switch a customer session to another customer account, which exposes account data and private customer information. No user interaction is required. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog.
Affected
- Adobe Commerce: 0 to 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug (per official CVE record; verify the exact build ranges in APSB26-92)
- Adobe Commerce B2B: 0 to 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul
- Magento Open Source: 0 to 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul
Fixed in
- Adobe Commerce: 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug
- Adobe Commerce B2B: 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug
- Magento Open Source: 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug
- Fix is an isolated patch per Adobe KB ka-40380; apply the patch matching your exact version. Exact fixed build numbers per branch: Unknown.
Workaround
- No official Adobe workaround known. Applying the isolated patch is the stated remedy.
- Sansec reports that Sansec Shield blocks exploitation attempts; coverage not verified.
Exploitation
- Known exploited: CISA added the vulnerability to the KEV catalog on 2026-09-24 (due date 2026-09-27).
- Security Affairs reported exploitation shortly after disclosure (13 Aug 2026); not independently verified.
- Adobe stated at publication that it was not aware of exploitation; current advisory status unconfirmed.
- Public proof of concept: Unknown.
- Ransomware use: Unknown.
Our recommendation
- Treat as urgent. Confirm the installed Adobe Commerce, B2B or Magento Open Source build.
- Apply the APSB26-92 isolated patch for your exact branch and test it on staging first.
- Restrict admin backend access by IP address.
- Review recent customer-account logins, session changes and unexplained customer-data access.
- Check whether customer data was exposed and assess reporting duties under the revised Swiss FADP with your data-protection advisor.
- Monitor the APSB26-92 page for updates.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (2 repositories)
dinosn/cve-2026-71362-magento-lab · mahumadad/cve-2026-71362-magento-ato
Research sources
- Adobe Security Bulletin APSB26-92 helpx.adobe.com
- CISA Known Exploited Vulnerabilities Catalog www.cisa.gov
- CISA KEV addition alert 2026-09-24 www.cisa.gov
- Adobe KB ka-40380 isolated patch experienceleague.adobe.com
- Sansec analysis of APSB26-92 sansec.io
- Iovista APSB26-92 blog www.iovista.com
- Rescana CVE-2026-71362 analysis www.rescana.com
- Strix CVE-2026-71362 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:56.
Original description (NVD)
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.
Required action (CISA)
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.