cyfenced.com →

[ CVE-2026-71362 · Published 11 Aug 2026 ]

Privilege escalation in Adobe Commerce and Magento

Exploited · CISA KEV CVSS 9.1 EPSS 88%No fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-09-24
  • EPSS: 88% chance of exploitation in the next 30 days (higher than 100% of CVEs)
  • Critical severity: CVSS 9.1

[ Analyst view ]Is this a red alert for you?

Red alert

CISA lists it as exploited, and it needs no credentials or user action.

Red alert if
You run a self-hosted Adobe Commerce or Magento Open Source shop on an affected version.
Can wait if
You do not run Adobe Commerce or Magento, or your hosting provider has confirmed APSB26-92 is installed.
What it is
An incorrect authorisation flaw in Adobe Commerce, Adobe Commerce B2B and Magento Open Source lets an attacker gain elevated access to sensitive resources without user interaction. The listed versions up to the July and August 2026 releases are affected.
Impact
An attacker without an account can gain elevated access to the shop and read or change sensitive data. Web shops are a common target for stealing customer data and injecting payment skimming code, which leads to card fraud, notification duties under GDPR and loss of trust.

How an attack would work MITRE ATT&CK

  1. T1190 Exploit Public-Facing ApplicationThe attacker sends crafted requests to the public shop.
  2. T1098 Account ManipulationElevated access can be used to create or change administrator accounts.
  3. T1565 Data ManipulationThey can change shop content, for example to inject payment skimming code.
  4. T1005 Data from Local SystemCustomer and order data is read from the shop.

What to do

  1. Install the security update from Adobe bulletin APSB26-92 for Adobe Commerce, Commerce B2B and Magento Open Source.
  2. Review administrator accounts, integrations and API tokens for entries you did not create.
  3. Check checkout pages, templates and CMS blocks for scripts you do not recognise.
  4. If you find signs of compromise, rotate admin and API credentials and follow your breach process for customer data.
Written with AI from the sources on this page on 23 Oct 2026. Check the vendor's advisory before you act.

[ Description ]Official description

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.

CISA: Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 27 Sep 2026): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References