CVE Details

CVE-2026-71362 Adobe Commerce and Magento Incorrect Authorization Vulnerability
Published: 2026-09-24 CVSS: 9.1 CRITICAL Product: Adobe Commerce and Magento Due Date: 2026-09-27

Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.

GitHub PoC

Warning: GitHub PoC repositories are unverified. Some may be fake or contain malware. Use caution and review code before running anything.
  • dinosn/cve-2026-71362-magento-lab • ⭐ 5 • 2026-08-15 • Conf: 95.0%
  • One-command Docker lab reproducing CVE-2026-71362 (Adobe Commerce / Magento Open Source customer-session identity-switch account takeover, APSB26-92, CVSS 9.1) with a PoC and an A/B/A official-patch negative control. For authorized security research and education.

FIRST EPSS

EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.

Timeline

CVE Stalker KEV MITRE GitHub FIRST (EPSS)

MITRE

CVSS

  • Score: 9.1
  • Severity: CRITICAL
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

  • Exploitation: active
  • Automatable: yes
  • Technical Impact: total

References

Show Raw Data
Key Remaining Key Value
dataType CVE_RECORD
dataVersion 5.2
cveMetadata > cveId CVE-2026-71362
cveMetadata > assignerOrgId 078d4453-3bcd-4900-85e6-15281da43538
cveMetadata > state PUBLISHED
cveMetadata > assignerShortName adobe
cveMetadata > dateReserved 2026-08-05T23:51:57.377Z
cveMetadata > datePublished 2026-08-11T17:52:48.311Z
cveMetadata > dateUpdated 2026-09-24T19:58:23.941Z
containers > cna > affected > 0 > defaultStatus unaffected
containers > cna > affected > 0 > product Adobe Commerce
containers > cna > affected > 0 > vendor Adobe
containers > cna > affected > 0 > versions > 0 > lessThanOrEqual 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug
containers > cna > affected > 0 > versions > 0 > status affected
containers > cna > affected > 0 > versions > 0 > version 0
containers > cna > affected > 0 > versions > 0 > versionType custom
containers > cna > affected > 0 > versions > 1 > status unaffected
containers > cna > affected > 0 > versions > 1 > version 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug
containers > cna > affected > 0 > versions > 1 > versionType custom
containers > cna > affected > 1 > defaultStatus unaffected
containers > cna > affected > 1 > product Adobe Commerce B2B
containers > cna > affected > 1 > vendor Adobe
containers > cna > affected > 1 > versions > 0 > lessThanOrEqual 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul
containers > cna > affected > 1 > versions > 0 > status affected
containers > cna > affected > 1 > versions > 0 > version 0
containers > cna > affected > 1 > versions > 0 > versionType custom
containers > cna > affected > 1 > versions > 1 > status unaffected
containers > cna > affected > 1 > versions > 1 > version 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug
containers > cna > affected > 1 > versions > 1 > versionType custom
containers > cna > affected > 2 > defaultStatus unaffected
containers > cna > affected > 2 > product Magento Open Source
containers > cna > affected > 2 > vendor Adobe
containers > cna > affected > 2 > versions > 0 > lessThanOrEqual 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul
containers > cna > affected > 2 > versions > 0 > status affected
containers > cna > affected > 2 > versions > 0 > version 0
containers > cna > affected > 2 > versions > 0 > versionType custom
containers > cna > affected > 2 > versions > 1 > status unaffected
containers > cna > affected > 2 > versions > 1 > version 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug
containers > cna > affected > 2 > versions > 1 > versionType custom
containers > cna > datePublic 2026-08-11T17:00:00.000Z
containers > cna > descriptions > 0 > lang en
containers > cna > descriptions > 0 > value Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.
containers > cna > metrics > 0 > cvssV3_1 > attackComplexity LOW
containers > cna > metrics > 0 > cvssV3_1 > attackVector NETWORK
containers > cna > metrics > 0 > cvssV3_1 > availabilityImpact NONE
containers > cna > metrics > 0 > cvssV3_1 > availabilityRequirement NOT_DEFINED
containers > cna > metrics > 0 > cvssV3_1 > baseScore 9.1
containers > cna > metrics > 0 > cvssV3_1 > baseSeverity CRITICAL
containers > cna > metrics > 0 > cvssV3_1 > confidentialityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > confidentialityRequirement NOT_DEFINED
containers > cna > metrics > 0 > cvssV3_1 > environmentalScore 9.1
containers > cna > metrics > 0 > cvssV3_1 > environmentalSeverity CRITICAL
containers > cna > metrics > 0 > cvssV3_1 > exploitCodeMaturity NOT_DEFINED
containers > cna > metrics > 0 > cvssV3_1 > integrityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > integrityRequirement NOT_DEFINED
containers > cna > metrics > 0 > cvssV3_1 > modifiedAttackComplexity LOW
containers > cna > metrics > 0 > cvssV3_1 > modifiedAttackVector NETWORK
containers > cna > metrics > 0 > cvssV3_1 > modifiedAvailabilityImpact NONE
containers > cna > metrics > 0 > cvssV3_1 > modifiedConfidentialityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > modifiedIntegrityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > modifiedPrivilegesRequired NONE
containers > cna > metrics > 0 > cvssV3_1 > modifiedScope UNCHANGED
containers > cna > metrics > 0 > cvssV3_1 > modifiedUserInteraction NONE
containers > cna > metrics > 0 > cvssV3_1 > privilegesRequired NONE
containers > cna > metrics > 0 > cvssV3_1 > remediationLevel NOT_DEFINED
containers > cna > metrics > 0 > cvssV3_1 > reportConfidence NOT_DEFINED
containers > cna > metrics > 0 > cvssV3_1 > scope UNCHANGED
containers > cna > metrics > 0 > cvssV3_1 > temporalScore 9.1
containers > cna > metrics > 0 > cvssV3_1 > temporalSeverity CRITICAL
containers > cna > metrics > 0 > cvssV3_1 > userInteraction NONE
containers > cna > metrics > 0 > cvssV3_1 > vectorString CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
containers > cna > metrics > 0 > cvssV3_1 > version 3.1
containers > cna > metrics > 0 > format CVSS
containers > cna > metrics > 0 > scenarios > 0 > lang en
containers > cna > metrics > 0 > scenarios > 0 > value GENERAL
containers > cna > problemTypes > 0 > descriptions > 0 > cweId CWE-863
containers > cna > problemTypes > 0 > descriptions > 0 > description Incorrect Authorization (CWE-863)
containers > cna > problemTypes > 0 > descriptions > 0 > lang en
containers > cna > problemTypes > 0 > descriptions > 0 > type CWE
containers > cna > providerMetadata > orgId 078d4453-3bcd-4900-85e6-15281da43538
containers > cna > providerMetadata > shortName adobe
containers > cna > providerMetadata > dateUpdated 2026-08-27T22:34:14.520Z
containers > cna > references > 0 > tags > 0 vendor-advisory
containers > cna > references > 0 > url https://helpx.adobe.com/security/products/magento/apsb26-92.html
containers > cna > source > discovery EXTERNAL
containers > cna > title Adobe Commerce | Incorrect Authorization (CWE-863)
containers > cna > x_generator > engine cvelib 1.8.0
containers > adp > 0 > metrics > 0 > other > type ssvc
containers > adp > 0 > metrics > 0 > other > content > id CVE-2026-71362
containers > adp > 0 > metrics > 0 > other > content > role CISA Coordinator
containers > adp > 0 > metrics > 0 > other > content > options > 0 > Exploitation active
containers > adp > 0 > metrics > 0 > other > content > options > 1 > Automatable yes
containers > adp > 0 > metrics > 0 > other > content > options > 2 > Technical Impact total
containers > adp > 0 > metrics > 0 > other > content > version 2.0.3
containers > adp > 0 > metrics > 0 > other > content > timestamp 2026-09-24T19:40:07.950551Z
containers > adp > 0 > metrics > 1 > other > type kev
containers > adp > 0 > metrics > 1 > other > content > dateAdded 2026-09-24
containers > adp > 0 > metrics > 1 > other > content > reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-71362
containers > adp > 0 > references > 0 > url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-71362
containers > adp > 0 > references > 0 > tags > 0 government-resource
containers > adp > 0 > title CISA ADP Vulnrichment
containers > adp > 0 > providerMetadata > orgId 134c704f-9b21-4f2e-91b3-4a467353bcc0
containers > adp > 0 > providerMetadata > shortName CISA-ADP
containers > adp > 0 > providerMetadata > dateUpdated 2026-09-24T19:58:23.941Z
containers > adp > 0 > timeline > 0 > time 2026-09-24T00:00:00.000Z
containers > adp > 0 > timeline > 0 > lang en
containers > adp > 0 > timeline > 0 > value CVE-2026-71362 added to CISA KEV