Unauthenticated incorrect-authorization flaw in Adobe Commerce and Magento Open Source exposes restricted resources (CVE-2026-71362)
CISA added this flaw to the KEV catalog on 2026-09-24 with a 2026-09-27 remediation deadline, VulnCheck lists a public exploit in XDB, and storefronts still on the July/August 2026 patch levels remain exposed to unauthenticated access to restricted data.
An incorrect authorization check in Adobe Commerce, Commerce B2B, and Magento Open Source lets a remote attacker with no credentials and no user interaction gain elevated access to sensitive resources over the network. The CVSS 9.1 vector rates confidentiality and integrity impact as high.
Affected: Adobe Commerce <= 2.4.9-2026-jul; Adobe Commerce <= 2.4.8-2026-aug; Adobe Commerce <= 2.4.7-2026-aug; Adobe Commerce <= 2.4.6-2026-aug; Adobe Commerce <= 2.4.5-2026-aug; Adobe Commerce <= 2.4.4-2026-aug; Adobe Commerce B2B <= 1.5.3-2026-jul; Adobe Commerce B2B <= 1.5.2-2026-jul; Adobe Commerce B2B <= 1.4.2-2026-jul; Adobe Commerce B2B <= 1.3.4-2026-jul; Adobe Commerce B2B <= 1.3.3-2026-jul; Adobe Magento Open Source <= 2.4.9-2026-jul; Adobe Magento Open Source <= 2.4.8-2026-jul; Adobe Magento Open Source <= 2.4.7-2026-jul; Adobe Magento Open Source <= 2.4.6-2026-jul
How to Test
Check the installed Adobe Commerce / Magento Open Source / Commerce B2B version and security-patch level against the affected list: anything at or before the 2026-jul (Magento Open Source, B2B, Commerce 2.4.9) or 2026-aug (Commerce 2.4.4–2.4.8) patch levels is vulnerable. Because exploitation requires no authentication, review web server access logs and Commerce admin/API logs for unauthenticated requests reaching restricted resources or admin functionality, and audit for unexpected admin accounts, API integrations, or configuration changes since the August 2026 disclosure.
How to Patch
Install the security update published in Adobe advisory APSB26-92 for your Adobe Commerce, Commerce B2B, or Magento Open Source release line; the 2026-jul and 2026-aug patch levels listed above remain vulnerable and must be superseded by the APSB26-92 release. If the update cannot be applied immediately, restrict network access to the storefront's admin and API paths until it is.