> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # CVE-2026-71362 Adobe Commerce and Magento : Adobe Commerce and Magento Incorrect Authorization Vulnerability - URL: https://f4n6.co.uk/security-feed/cve-2026-71362-adobe-commerce-and-magento-adobe-commerce-and-magento-incorrect-authorization-vulnerability/ - Published: 2026-09-24T22:55:15.000Z - Updated: 2026-09-24T22:55:15.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-71362 ## 1\. Executive summary CVE-2026-71362 is an incorrect authorization flaw (CWE-863) in Adobe Commerce and Magento that lets an attacker bypass authorization checks and reach sensitive resources without any user interaction. The verified reference data records it at CVSS 9.1 (critical), not listed in CISA KEV, with an EPSS score of 2%. One vendor report states that exploitation attempts began shortly after Adobe released patches; that claim is single-sourced and is not reflected in the KEV catalogue, so treat in-the-wild activity as probable but unconfirmed. For EMEA financial services the exposure is concentrated in internet-facing Commerce or Magento deployments, including headless commerce APIs and customer-facing storefronts, where an unauthenticated read (and, per one advisory, write) primitive against order, customer or payment-adjacent data is a direct data-protection and fraud concern. The absence of a KEV listing and a 2% EPSS score argue against treating this as an emergency across the whole estate, but any institution running an unpatched, internet-exposed instance should patch on the vendor's timeline rather than wait for exploitation to be corroborated. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. The item is a vendor vulnerability disclosure. It does not, on the material available, establish that any client has suffered an ICT-related incident, so the DORA incident classification and reporting chain (Art. 18, Art. 19) and the NIS2 incident reporting obligation (Art. 23) are not triggered by the disclosure itself. Those articles become engaged only if a client's own Commerce instance shows evidence of unauthorised access, at which point the classification and reporting clocks start from the client's detection, not from this advisory. The third-party and supply-chain articles (DORA Art. 28, Art. 29, Art. 30; NIS2 Art. 21(2)(d)) would be engaged by the contractual and concentration analysis a client has already performed on Adobe as an ICT provider, not by this CVE specifically, and this advisory does not change what those articles require. DORA Art. 17 and Art. 24 remain relevant to the client's standing patch and resilience-testing process, but again the trigger is the client's own process, not a fact distinctive to this item. ## 3\. Technical analysis & attack chain Confirmed steps, from the source material: 1. The attacker reaches an internet-exposed Adobe Commerce or Magento instance. The sources do not describe how targets were selected or whether scanning was involved. 2. The attacker sends a request that reaches a component where the authorization check is missing or incorrect. The advisory text states that exploitation does not require user interaction, so no victim session or social engineering step is needed. 3. The authorization check fails open. The attacker gains access to resources their privilege level should not permit. The verified reference data classifies the flaw as CWE-863 (Incorrect Authorization) at CVSS 9.1, which is consistent with the source description of an "incorrect authorization" vulnerability. The two GitHub Security Advisories in the source set describe different impact scopes for what both call an Adobe Commerce incorrect authorization issue: GHSA-5g6h-388x-r7r7 describes a security feature bypass leading to unauthorised read access, while GHSA-cv9f-fh36-ww7h describes a low-privileged attacker obtaining unauthorised read and write access with limited disruption to availability. The source material does not confirm whether these two advisories map to CVE-2026-71362 or to separate CVEs in the same patch cycle, so the write capability should be treated as possible rather than established for this CVE. What the sources do not provide, and what a defender would need: the affected Commerce and Magento version ranges, the vulnerable component or module, the endpoint or request structure used, and whether the bypass is in an API (REST or GraphQL), an admin controller, or a storefront path. None of that is present in the material supplied, and it is not inferred here. Two related items should not be conflated with this CVE. The BSI advisories (WID-SEC-2026-2367 and WID-SEC-2026-3246) are bundle advisories covering multiple Magento flaws and list privilege escalation, arbitrary code execution, security bypass, cross-site scripting and information disclosure across the set; they are not specific to CVE-2026-71362 and cannot be used to attribute those capabilities to it. Separately, the related source lists CVE-2026-75650, an improper neutralization of special elements used in a template engine flaw in Adobe Commerce and Magento Open Source that permits arbitrary code execution, as a CISA KEV entry with a remediation due date of 2026-09-11\. That is a different vulnerability with a different mechanism and a different exploitation status. Discrepancy to note: the primary item's text carries CISA KEV-style remediation language and a due date of 2026-09-27, but the verified reference data records CVE-2026-71362 as not in CISA KEV. The verified state governs; the 2026-09-27 date is the source's stated remediation deadline, not a KEV due date. Confidence caveat: the claim that exploitation attempts were observed immediately after patch release rests on a single vendor report (SecurityWeek). No second source in this set corroborates it, and the KEV catalogue does not list the CVE. Treat active exploitation as unconfirmed. ## 4\. Mitigation & containment ### P1 (within 24 hours) - Inventory every internet-exposed Adobe Commerce and Magento instance, including headless deployments where the Commerce API is reachable without the storefront. The verified data gives no affected version range, so treat all unpatched versions as in scope until Adobe's bulletin narrows it. - Apply Adobe's security update for the affected Commerce and Magento releases. SecurityWeek states that Adobe released patches for this issue; the source material does not give version numbers, so take the target versions from Adobe's own security bulletin rather than from this advisory. - Where patching cannot be completed inside 24 hours, remove the instance from untrusted networks: restrict the admin path and any REST or GraphQL endpoints to known source addresses at the reverse proxy or WAF, and disable unused modules and integrations. This is a compensating control, not a fix. - Confirm MFA is enforced on all Commerce admin accounts and that integration and service accounts use least-privilege ACLs. The flaw bypasses authorization, so these controls reduce blast radius rather than block the vector. ### P2 (within 72 hours) - Review reverse proxy, WAF and Commerce application logs for successful requests to Commerce endpoints that completed without an authenticated session, and for reads or writes by low-privilege accounts outside their normal access pattern. The source material gives no signature for this, so the review is behavioural (see §5). - Check whether the separately tracked CVE-2026-75650, listed as a KEV entry in the related source with a 2026-09-11 due date, is remediated on the same estate. It is a remote code execution flaw in the same product family and, if still open, is the higher-priority item of the two. - Verify that Adobe Commerce instances are not directly reachable from the internet where a CDN or WAF front end is intended to sit in front of them. ### P3 (within 7 days) - Add Commerce and Magento patch currency to the standing third-party risk review, so version state is checked on a defined cadence rather than at disclosure. - Re-test the access-control configuration of any custom Commerce module or integration written in-house, since incorrect authorization defects in custom code are not covered by vendor patches. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The sources contain no hashes, domains, IP addresses, file paths, registry keys or command lines. The sources do describe observable behaviour, so the following detection hypotheses are offered. They are derived from the advisory descriptions, not from observed telemetry, and carry low confidence. | behaviour | where to observe | confidence | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------ | ---------- | | Requests to Commerce endpoints that complete successfully without an authenticated session, consistent with exploitation requiring no user interaction | reverse proxy, WAF and Commerce application logs | low | | Reads or writes of order, customer or configuration data by a low-privilege account outside its normal access pattern, consistent with the unauthorised read and write access described in GHSA-cv9f-fh36-ww7h | Commerce application logs, database audit logs | low | ## 6\. Detection Insufficient indicators to author detection rules. The source material contains no threat artefacts: no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, ransom-note text or hard-coded values. CVE identifiers and product names are not threat artefacts and would produce rules that match reporting about the vulnerability rather than exploitation of it. ## CVE assessment 1 referenced CVE — 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------ | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-71362](https://nvd.nist.gov/vuln/detail/CVE-2026-71362?ref=f4n6.co.uk) | 9.1 Critical | — | 2% | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker c… | ## 7\. Sources - NVD, CVE-2026-71362 detail, https://nvd.nist.gov/vuln/detail/CVE-2026-71362, published 2026-09-23 - GitHub Security Advisories, GHSA-5g6h-388x-r7r7, https://github.com/advisories/GHSA-5g6h-388x-r7r7, date not stated - GitHub Security Advisories, GHSA-cv9f-fh36-ww7h, https://github.com/advisories/GHSA-cv9f-fh36-ww7h, date not stated - SecurityWeek, Adobe Commerce Bug Targeted Immediately After Disclosure, https://www.securityweek.com/adobe-commerce-bug-targeted-immediately-after-disclosure/, date not stated - BSI Germany, WID-SEC-2026-2367, Adobe Magento: Mehrere Schwachstellen, https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2367, date not stated - BSI Germany, WID-SEC-2026-3246, Adobe Magento: Mehrere Schwachstellen, https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3246, date not stated - NVD, CVE-2026-75650 detail, https://nvd.nist.gov/vuln/detail/CVE-2026-75650, date not stated ## 8\. Adverse Trace position We assess CVE-2026-71362 at CVSS 9.1 (critical) per the verified reference data, not listed in CISA KEV, with EPSS at 2%. The severity is high but the exploitation evidence is thin: the only claim of in-the-wild activity is single-sourced to SecurityWeek and is not corroborated by the KEV catalogue, so we are not raising this to an estate-wide emergency. Client impact is concentrated in institutions running internet-exposed Commerce or Magento, particularly where the Commerce API is reachable directly rather than behind a WAF, and where order or customer data sits behind the affected authorization check. We will track Adobe's bulletin for the affected version ranges and the vulnerable component, since neither is present in the material available to us, and we will re-issue this advisory if a second source corroborates exploitation or if the CVE is added to KEV. Clients who need a decision today should patch internet-exposed instances on the vendor timeline and treat the log review in §4 P2 as the compensating check until version detail is available. --- [Read the original source →](https://nvd.nist.gov/vuln/detail/CVE-2026-71362?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*