Adobe Commerce: Incorrect authorization allows arbitrary code execution

Summary

Adobe Commerce contains an Incorrect Authorization flaw (CWE-863) that is addressed in Adobe security bulletin APSB26-153. An unauthenticated attacker on the network can exploit it without user interaction to execute arbitrary code in the context of the current user, with a CVSS 3.1 base score of 9.8. Adobe's bulletin tags this CVE with the note B2B, while the CVE record and third-party sources list Adobe Commerce, Commerce B2B and Magento Open Source, so the exact scope must be verified on Adobe's bulletin.

Affected

• Adobe Commerce 2.4.4 to 2.4.9 (builds labeled 2026-sep and earlier, per Adobe bulletin)
• Adobe Commerce B2B 1.3.3 to 1.5.3 (builds labeled 2026-sep and earlier)
• Magento Open Source 2.4.6 to 2.4.9 (builds labeled 2026-sep and earlier)
• Scope note: Adobe's bulletin tags CVE-2026-92909 with B2B; verify whether the flaw affects only the B2B module

Fixed in

• Adobe Commerce: 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-oct
• Adobe Commerce B2B: 1.5.4-alpha1, 1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, 1.3.3-2026-oct
• Magento Open Source: 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct
• The September hotfix for CVE-2026-75650 (APSB26-146) must remain installed

Workaround

Unknown.

• No vendor workaround was identified; patching is the fix Adobe points to.
• Interim measure (not from vendor): restrict access to admin and B2B areas where possible and review logs for unusual requests until patched.

Exploitation

• Adobe is not aware of any exploits in the wild for the issues in this update.
• CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
• No public exploit or technical details were found in the sources reviewed; CISA KEV was not checked.

Our recommendation

• Identify all Adobe Commerce, B2B and Magento Open Source installations and their exact versions.
• Update to the October 2026 build for your release line (or 2.4.10-alpha1 where applicable) using Adobe's bulletin APSB26-153.
• Keep the September hotfix for CVE-2026-75650 installed.
• Restrict admin and B2B access where possible, monitor logs, and check CISA KEV and exploit listings regularly.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Adobe Security Bulletin APSB26-153 www.adobe.com
• Cyberexperts: Online stores on Adobe Commerce and Magento takeover bug cyberexperts.com
• Meetanshi: APSB26-153 security patches for Magento meetanshi.com
• Safeguard: APSB26-153 analysis safeguard.sh
• VulDB: CVE-2026-92909 vuldb.com
• Strix: CVE-2026-92909 www.strix.ai
• PRLog: APSB26-153 fixes 11 Adobe Commerce flaws www.prlog.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:23.