- Critical 9.1
- Known exploited (CISA KEV)
CVE-2026-71362
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.
Scores
The facts
- Published
- 11 August 2026
- Last changed
- 25 September 2026
- NVD status
- Analyzed
- Severity
- Critical, CVSS 9.1 out of 10 (version 3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- Affects
- adobe commerce
- adobe commerce b2b
- adobe magento
- Known exploited
- Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on 24 September 2026.
- EPSS
- 87.5% chance of exploitation activity in the next 30 days (percentile 100).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.