CVE-2026-71362: Adobe Commerce Incorrect Authorization

CVE-2026-71362 is a critical incorrect-authorization flaw in Adobe Commerce, Adobe Commerce B2B and Magento Open Source that lets an attacker gain elevated access to sensitive resources without any user interaction, and it is listed in the CISA KEV catalog as actively exploited, with one of the highest EPSS scores of any CVE tracked this round.

CVE-2026-71362 is a CWE-863 (Incorrect Authorization) vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source. NVD's description states: "Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction" (NVD).

NVD lists the CVE as fully analyzed (status "Analyzed") with a CVSS v3.1 base score of 9.1 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N — network-reachable, low attack complexity, no privileges or user interaction required, high impact to confidentiality and integrity, no availability impact. The score is attributed to Adobe's own PSIRT (source [email protected]) and carried by NVD as the record's accepted severity data (NVD).

NVD's own CPE applicability data (fetched this run) shows the vulnerable range spans Adobe Commerce 2.4.4 through every 2.4.9 patch build, Adobe Commerce B2B 1.3.3 through every 1.5.3 patch build, and Magento Open Source up to and including 2.4.6 plus every 2.4.7-2.4.9 patch build — i.e., effectively all mainstream Commerce/Magento releases prior to the August 2026 security patch set (NVD).

CISA added CVE-2026-71362 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-24, with a required-action due date of 2026-09-27 and known ransomware campaign use listed as "Unknown" (CISA KEV).

Adobe's own security bulletin (APSB26-92), which CISA cites for the official affected-version and patch list, returned HTTP 403 when fetched directly during this review. In its place, this page relies on NVD's CNA-sourced CPE data (reproduced in Affected Components above) and the CISA KEV entry; operators should also check the Adobe bulletin directly once reachable for exact patch build numbers.

As of 2026-10-26, FIRST scores the probability of exploitation at 0.90491 (99.799th percentile) — among the highest EPSS scores of any CVE covered on this site, consistent with a critical, unauthenticated-reach, no-user-interaction flaw in widely deployed e-commerce software that is already being exploited in the wild (FIRST EPSS).

Because this flaw lets an attacker escalate privileges and reach sensitive store resources with no user interaction, any Adobe Commerce, Adobe Commerce B2B or Magento Open Source deployment on an affected build should be patched to the August 2026 (or later) security release immediately, and operators should review admin-account and API access logs for signs of unauthorized privilege escalation.

• Incorrect authorization vulnerability lets an attacker gain elevated access to sensitive resources without user interaction (CWE-863). — NVD
• NVD status is Analyzed with CVSS v3.1 base score 9.1 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, sourced from Adobe PSIRT. — NVD
• CPE configuration data shows Adobe Commerce 2.4.4-2.4.9 (all listed patch builds), Adobe Commerce B2B 1.3.3-1.5.3 (all listed patch builds), and Magento Open Source up to 2.4.6 plus 2.4.7-2.4.9 (all listed patch builds) are vulnerable. — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-24, due date 2026-09-27, ransomware use Unknown. — CISA KEV
• EPSS score is 0.90491 (99.799th percentile) as of 2026-10-26. — FIRST EPSS