CVE-2026-71362: Adobe Commerce and Magento incorrect authorization

CVE-2026-71362 · Severity: critical · CVSS 9.1 · Exploited in the wild · Published 2026-08-11

Adobe Commerce and Magento are e-commerce platforms used by businesses to build and manage online stores. This vulnerability allows an attacker to bypass authorization controls and gain elevated access to sensitive administrative resources without needing user interaction. An exploit could enable unauthorized account takeover, data theft, or modification of products and orders.

Technologies: Adobe Commerce, Adobe Magento. Vendors: Adobe.

Quick answers

Is CVE-2026-71362 exploited in the wild?
Yes. CVE-2026-71362 is known to be exploited in the wild, first recorded on 24 September 2026. Treat it as urgent.
How severe is CVE-2026-71362?
Critical severity, with a CVSS score of 9.1, published 11 August 2026.
Which products and versions are affected?
Adobe Adobe Commerce; Adobe Magento.
Is there a fix for CVE-2026-71362?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-71362 attacked?
It is attacked over the network.
Am I affected by CVE-2026-71362?
Check whether you run Adobe Commerce or Adobe Magento. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is an incorrect authorization flaw in Adobe Commerce and Magento that allows attackers to bypass access controls and obtain elevated privileges. The vulnerability does not require user interaction, meaning an attacker can exploit it directly against vulnerable instances. The attack vector is network-based, suggesting the flaw is reachable remotely. The vulnerability has been actively exploited in the wild, indicating real-world attack campaigns are targeting affected systems. Patches should be applied immediately to all affected Commerce and Magento installations.

Affected products

  • Adobe Adobe Commerce
  • Adobe Magento

Timeline

  • 2026-09-24: disclosed
  • 2026-09-24: exploited

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.