CVE-2026-71362 Adobe Commerce and Magento Incorrect Authorization Vulnerability

Exploited in the wild Critical 9.1 Published 11 Aug 2026 Updated 25 Sep 2026

An attacker can gain elevated access to sensitive resources in Adobe Commerce without user interaction due to incorrect authorization checks.

Exploited in the wild: Since 24 Sep 2026
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-71362?

CVE-2026-71362 is a critical missing authorization vulnerability in Adobe Commerce, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.

Weakness: CWE-863

Which versions are affected by CVE-2026-71362?

It affects 3 products.

Products include Adobe Commerce, Adobe Commerce B2b, Adobe Magento.

How do I fix CVE-2026-71362?

Apply the vendor's patch. US federal agencies must fix it by 27 Sep 2026.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-71362 being exploited?

Yes. Attackers have exploited CVE-2026-71362 in the wild since at least 24 Sep 2026.

Public exploit code: 1 Nuclei template and 2 proofs of concept on GitHub.

All Adobe Commerce vulnerabilities

Sources

Also known as GHSA-f58v-hxr9-8947, ROOT-APP-COMPOSER-CVE-2026-71362.