VulnTideExploited vulnerabilities, by vendor. Data as of 28 Oct 2026.
Known exploitedIn CISA's KEV catalog since 24 September 2026Ransomware use: unknown
Adobe Commerce and Magento

CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability

Is it exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 24 Sep 2026, 44 days after the CVE record was published.

How likely is exploitation in the next 30 days?
90.5%

EPSS score, percentile 99.8 of all scored records

How severe?
9.1 Critical

CVSS v3.1 base score, given by the CNA

What should I do?

CISA deadline 27 Sep 2026. Apply mitigations in accordance with vendor instructions … Full text

Advisories and patches (1)

Which versions are affected?

Affected

  • 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug,… and earlier
  • 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul and earlier
  • 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul and earlier

Unaffected 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug,…; 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug; 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug

Versions by product

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

What to do

Required action, set by CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CISA due date for this action: 27 September 2026.

Advisories and patches

Linked from CISA's catalog entry

Affected products and versions

As listed in the CVE record.

Adobe Adobe Commerce
StatusVersions
Affected2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug,… and earlier
Unaffected2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug,…

Versions not listed are: unaffected.

Adobe Adobe Commerce B2B
StatusVersions
Affected1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul and earlier
Unaffected1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug

Versions not listed are: unaffected.

Adobe Magento Open Source
StatusVersions
Affected2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul and earlier
Unaffected2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug

Versions not listed are: unaffected.

Versions the record lists as unaffected: 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug,…, 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug, 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

About this vulnerability

Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.

Summary: CISA's KEV catalog, as of 28 Oct 2026.

  • CISA added CVE-2026-71362 to its Known Exploited Vulnerabilities (KEV) catalog on 24 Sep 2026.
  • CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
  • The due date CISA sets for the required action is 27 Sep 2026.
  • The CVE record was published on 11 Aug 2026, 44 days before it was added to KEV.
  • The CVE record carries a CVSS v3.1 base score of 9.1 (Critical), given by its CNA.
  • FIRST's EPSS model puts the probability of exploitation in the next 30 days at 90.5% (percentile 99.8), as of 28 Oct 2026.
  • CISA's SSVC assessment in the CVE record: exploitation active, automatable yes, technical impact total.

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.

Description

Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

Weakness

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.

Timeline

DateEvent
11 Aug 2026CVE record published
24 Sep 2026Added to CISA KEV
25 Sep 2026CVE record last updated
27 Sep 2026CISA due date for the required action

More exploited Adobe vulnerabilities

  • CVE-2026-48356: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability (added 27 Oct 2026)
  • CVE-2026-75650: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability (added 8 Sep 2026)
  • CVE-2026-48282: Adobe ColdFusion Path Traversal Vulnerability (added 7 Jul 2026)
  • CVE-2009-3459: Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability (added 20 May 2026)
  • CVE-2020-9715: Adobe Acrobat Use-After-Free Vulnerability (added 13 Apr 2026)
  • CVE-2026-34621: Adobe Acrobat and Reader Prototype Pollution Vulnerability (added 13 Apr 2026)