Adobe Commerce B2B: Incorrect authorization leads to security feature bypass
Summary
Adobe Commerce B2B contains an incorrect authorization flaw (CWE-863) that allows a low-privileged authenticated user to bypass security measures. The attacker can gain unauthorized read and write access and cause a limited impact on availability. No user interaction is required, and Adobe rates the vulnerability as high severity (CVSS 8.3).
Affected
- Adobe Commerce B2B 1.5.3-2026-sep and earlier
- Adobe Commerce B2B 1.5.2-2026-sep and earlier
- Adobe Commerce B2B 1.4.2-2026-sep and earlier
- Adobe Commerce B2B 1.3.4-2026-sep and earlier
- Adobe Commerce B2B 1.3.3-2026-sep and earlier
- Standard Adobe Commerce and Magento Open Source are not listed as affected for this CVE in the bulletin; check the vendor table for the Magento Open Source versions.
Fixed in
- Adobe Commerce B2B 1.5.3-2026-oct
- Adobe Commerce B2B 1.5.2-2026-oct
- Adobe Commerce B2B 1.4.2-2026-oct
- Adobe Commerce B2B 1.3.4-2026-oct
- Adobe Commerce B2B 1.3.3-2026-oct
- Exact build numbers: Unknown. Verify on Adobe's bulletin APSB26-153. The alpha 1.5.4-alpha1 is not a production fix.
- The September hotfix for CVE-2026-75650 must remain installed.
Workaround
Unknown. No vendor workaround has been published; Adobe recommends applying the update.
Exploitation
- Adobe is not aware of any exploits in the wild for this update.
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- CISA KEV status: Unknown, not verified.
Our recommendation
- Update Adobe Commerce B2B to the 2026-oct release for your branch as part of the October 2026 patch cycle.
- Keep the September hotfix for CVE-2026-75650 installed.
- Prioritise CVE-2026-92909 (CVSS 9.8, unauthenticated, B2B), which is more urgent.
- Review low-privileged and self-registered B2B accounts and restrict B2B account functions until patched.
- Monitor logs for unusual access to B2B account data.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-153 www.adobe.com
- Ontap: Adobe Commerce security update APSB26-153 www.ontapgroup.com
- Meetanshi: APSB26-153 security patches meetanshi.com
- EUVD record vulners.com
- Strix: CVE-2026-92908 www.strix.ai
- CyberExperts: Adobe Commerce cyberexperts.com
- Safeguard: APSB26-153 analysis safeguard.sh
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:51.
Original description (NVD)
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.