CVE Tools
Sign in

CVE-2026-71362

Adobe Commerce | Incorrect Authorization (CWE-863)

Published: Aug 11, 2026Updated: Aug 12, 2026 Sources: CVE List NVDCWE-863
9.1CRITICAL
NVD MITRE
EPSS Score
1.3%
Top 31.8%
CISA KEV
Not in KEV
Exploits
No Known Exploits
Remediation
No Fix Available
Self-Check
Nuclei · OpenVAS

Description

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.

In plain language

AI Act now

CVE-2026-71362 is an Adobe Commerce security flaw that lets an attacker access private customer data without logging in; small businesses running Adobe Commerce should treat this as urgent and update to a fixed version.

Executive summary

CVE-2026-71362 is an unauthenticated incorrect authorization issue in Adobe Commerce that can be used to hijack customer sessions and obtain elevated access to sensitive resources over the network.

If affected, business impact
Customer account takeoverPrivate customer data exposureSensitive data theft riskReputation and legal exposure

What to do now

  1. Check whether your business uses Adobe Commerce, Adobe Commerce B2B, or magento open source, and identify your currently installed version.
  2. If you are on an affected version, plan to upgrade immediately to one of the fixed releases: Adobe Commerce 2.4.9-2026-aug or 2.4.8-2026-aug or 2.4.7-2026-aug or 2.4.6-2026-aug or 2.4.5-2026-aug or 2.4.4-2026-aug.
  3. If you are using Adobe Commerce B2B, upgrade to 1.5.3-2026-aug or 1.5.2-2026-aug or 1.4.2-2026-aug or 1.3.4-2026-aug or 1.3.3-2026-aug.
  4. If you are using magento open source, upgrade to 2.4.9-2026-aug or 2.4.8-2026-aug or 2.4.7-2026-aug or 2.4.6-2026-aug.
  5. After upgrading, monitor for suspicious login/session behavior and review access logs for signs of session switching or abnormal account activity.
Usually a quick update

CVSS Vector Breakdown

AV:NAC:LPR:NUI:NS:UC:HI:HA:N
Exploitability
AV:NAttack Vector
Network
AC:LAttack Complexity
Low
PR:NPrivileges Required
None
UI:NUser Interaction
None
Scope
S:UScope
Unchanged
Impact
C:HConfidentiality
High
I:HIntegrity
High
A:NAvailability
None
Open in CVSS calculator →

Weaknesses

CWE-863

Affected Products

Adobe
commercial·USaka adobe systems inc.
Adobe Commerce
Consumer Software
Adobe Commerce B2BOn-prem
Consumer Software / productivity
Magento Open Source
Consumer Software

Exploitability

No known exploits, KEV entries, or remediation guidance available for this vulnerability yet.
Is your org exposed to CVE-2026-71362?We'll check your whole external perimeter for exposure — free. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

2 techniques
Initial Access
View detailed technique mapping

References

https://helpx.adobe.com/security/products/magento/apsb26-92.html
helpx.adobe.com
News mentions
5

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-71362 and every CVE in our database. Create a free account — no credit card required.

Create Free Account
Plain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows