CVE entry · CVE-2026-71362
CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability
Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.
- Actively exploited: added to CISA’s KEV catalog on September 24, 2026.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: September 27, 2026.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes Adobe Commerce and Magento , including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.
References
Other Adobe vulnerabilities
-
Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
-
Adobe ColdFusion Path Traversal Vulnerability
-
Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
-
Adobe Acrobat and Reader Prototype Pollution Vulnerability
-
Adobe Acrobat Use-After-Free Vulnerability
-
Adobe Commerce and Magento Improper Input Validation Vulnerability