Adobe Commerce and Magento Incorrect Authorization Vulnerability
TL;DR 📌
- Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.
- Highest CVSS: 9.1 (Critical).
- Listed in CISA KEV (2026-09-24) — this is being exploited in the wild.
- Fixed in
1.3.3,2.4.4— upgrade to this release or later. - CVEs: CVE-2026-71362.
What it is
CVE-2026-71362 is an incorrect authorization flaw in Adobe Commerce and Magento. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the flaw is reachable over the network, requires no privileges and no user interaction, and has low attack complexity. That combination points to an unauthenticated attacker being able to reach the affected authorization check directly.
The impact is elevated access to sensitive resources: the CVSS scoring shows high confidentiality and integrity impact with no availability impact, consistent with an attacker bypassing an authorization control to read or modify data they should not be able to touch, rather than crashing or disabling the platform.
Adobe’s own description frames this as a privilege escalation issue — the authorization logic incorrectly grants access, allowing an attacker to obtain elevated rights to sensitive resources without needing to authenticate first. The advisory does not specify which endpoint or module implements the faulty check; consult the advisory for that detail.
This CVE is listed in CISA’s Known Exploited Vulnerabilities catalogue, added on 2026-09-24, so it is known to be exploited.
What to do
- Patch to the fixed releases identified by Adobe: 1.3.3 and 2.4.4. Confirm which of these applies to your deployment before rolling out.
- Given the CVE’s presence in CISA KEV, treat this as a priority patching action rather than routine maintenance — schedule the update as soon as possible rather than in the next normal cycle.
- Because exploitation requires no authentication and no user interaction, do not rely on account lockouts, MFA, or user-awareness controls as mitigations; these do not address the underlying authorization flaw.
- Review Adobe’s advisory for any interim mitigation guidance or configuration workaround if immediate patching is not feasible.
- After patching, review Commerce/Magento access logs for the period before the fix for signs of unusual access to sensitive resources, given the KEV listing.
For leadership 🧭
Executive summary. A critical flaw in Adobe Commerce and Magento lets an attacker skip authentication entirely and reach protected data or settings, with confirmed exploitation in the wild. This needs emergency patching now, not scheduled maintenance.
Why it matters:
- The vulnerability sits in the authorization logic of Adobe Commerce and Magento, so any store running an unpatched instance is reachable over the network without credentials or user interaction.
- CVSS scoring shows high confidentiality and integrity impact with no availability loss, meaning the real risk is silent theft or tampering of sensitive resources (such as customer or order data) rather than an outage.
- CISA added this CVE to its Known Exploited Vulnerabilities catalogue on 2026-09-24, confirming active exploitation against Commerce/Magento installations.
- Standard defences like MFA, account lockouts or user training do nothing here, since the flaw bypasses authorization checks before any login is attempted.
Now / Next / Later:
- Now: Identify every Adobe Commerce or Magento instance you run and check its version against the fixed releases (1.3.3, 2.4.4) to determine exposure immediately.
- Next: Apply the appropriate fix during an emergency change window rather than the next scheduled cycle, given the confirmed exploitation and no viable interim mitigation for unauthenticated access.
- Later: Establish a process to track Adobe Commerce/Magento security releases against your deployed version and to review access logs after future advisories, so authorization flaws in this platform are caught and patched before exploitation is confirmed.