CVE-2026-71362
published 2026-08-11CVE-2026-71362: Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability…
PriorityP195critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2026-09-27
Exploited in the wild
EPSS
90.49%
99.8th percentile
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.
Affected
160 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | adobe_commerce | <= 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug | — |
| adobe | adobe_commerce_b2b | <= 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul | — |
| adobe | commerce | < 2.4.4 | 2.4.4 |
| adobe | commerce | — | — |
| adobe | commerce | — | — |
| adobe | commerce | — | — |
| adobe | commerce | — | — |
| adobe | commerce | — | — |
| adobe | commerce | — | — |
| adobe | commerce | — | — |
| adobe | commerce | — | — |
| adobe | commerce | — | — |
| adobe | commerce | — | — |
| adobe | commerce | — | — |
| adobe | commerce | — | — |
| adobe | commerce | — | — |
| adobe | commerce | — | — |
| adobe | commerce | — | — |
| adobe | commerce | — | — |
| adobe | commerce | — | — |
| adobe | commerce | — | — |
| adobe | commerce | — | — |
| adobe | commerce | — | — |
| adobe | commerce | — | — |
| adobe | commerce | — | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vulncheck9.1CRITICAL
cisa9.1CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Adobe Commerce/Commerce B2B/Magento Open Source improper authorization
vuldb·2026-09-15·CVSS 9.1
CVE-2026-71362 [CRITICAL] Adobe Commerce/Commerce B2B/Magento Open Source improper authorization
A vulnerability marked as critical has been reported in Adobe Commerce, Commerce B2B and Magento Open Source. This affects an unknown function. The manipulation leads to improper authorization.
This vulnerability is referenced as CVE-2026-71362. Remote exploitation of the attack is possible. No exploit is available.
It is suggested to upgrade the affected component.
GHSA
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation.
ghsa_unreviewed·2026-08-11
CVE-2026-71362 [CRITICAL] CWE-863 Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation.
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.
VulnCheck
Adobe commerce Incorrect Authorization
vulncheck·2026·CVSS 9.1
CVE-2026-71362 [CRITICAL] Adobe commerce Incorrect Authorization
Adobe commerce Incorrect Authorization
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.
Affected: Adobe commerce
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.trellix.com/blogs/research/the-bug-report-august-2026-edition/
Exploit PoC: https://vulncheck.com/xdb/964b9b046620
CISA
Adobe Commerce and Magento Incorrect Authorization Vulnerability
cisa·2026-09-24·CVSS 9.1
CVE-2026-71362 [CRITICAL] CWE-863 Adobe Commerce and Magento Incorrect Authorization Vulnerability
Vulnerability: Adobe Commerce and Magento Incorrect Authorization Vulnerability
Affected: Adobe Commerce and Magento
Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adher
No detection rules found.
Nuclei
Adobe Commerce/Magento - Customer Session Identity Switch
nuclei·CVSS 9.1
CVE-2026-71362 [CRITICAL] Adobe Commerce/Magento - Customer Session Identity Switch
Adobe Commerce/Magento - Customer Session Identity Switch
Adobe Commerce contains an incorrect authorization vulnerability caused by improper access control, letting attackers escalate privileges to access sensitive resources, exploit requires no user interaction.
Template:
id: CVE-2026-71362
info:
name: Adobe Commerce/Magento - Customer Session Identity Switch
author: 0x_Akoko,dinosn
severity: critical
description: |
Adobe Commerce contains an incorrect authorization vulnerability caused by improper access control, letting attackers escalate privileges to access sensitive resources, exploit requires no user interaction.
impact: |
Attackers can gain elevated access to sensitive resources, potentially compromising system integrity and data confidentiality.
remediation: |
Update to the l
Hackernews
WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV
blogs_hackernews·2026-09-25·CVSS 10.0
CVE-2026-5430 [CRITICAL] WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities ( KEV ) catalog, based on evidence of active exploitation.
The vulnerabilities are listed below -
CVE-2026-5430 (CVS score: 9.8) - A path traversal vulnerability in WSO2 API Control Plane, API Manager, Traffic Manager and Universal Gateway that could allow unrestricted file upload and lead to remote code execution.
CVE-2026-71362 (CVSS score: 9.1) - An incorre
Checkpoint
17th August – Threat Intelligence Report
blogs_checkpoint·2026-08-17
CVE-2026-68820 17th August – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 17th August – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 17th August, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
Colombia’s Ministry of Justice has experienced a ransomware attack that affected part of its technology infrastructure and disrupted public services related to illicit-drug monitoring and legal processes. Officials confirmed that some files were encrypted but stated that no data theft was detected during the incident.
MyDr, Poland’s primary
Hackernews
Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws
blogs_hackernews·2026-08-12·CVSS 10.0
CVE-2026-48362 [CRITICAL] Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws
Adobe has shipped updates to address multiple critical security vulnerabilities impacting ColdFusion, Commerce, and Campaign Classic that, if successfully exploited, could result in arbitrary code execution and privilege escalation.
The most severe of the flaws are listed below -
CVE-2026-48362 (CVSS score: 10.0) - An operating system command injection vulnerability in ColdFusion that could lead to arbitrary code execution (Fixed in 2025.0.12 and 2023.0.23)
CVE-2026-48273 (CVSS score: 9.9) - An eval injection vulnerability in ColdFusion that could lead to
2026-08-11
Published
2026-09-24
Added to CISA KEV
Exploited in the wild