# CVE-2026-71362: Adobe Commerce and Magento incorrect authorization

Source: https://junglewise.ai/threats/cve-2026-71362-adobe-commerce-and-magento-incorrect-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-71362 · Severity: critical · CVSS 9.1 · Exploited in the wild · Published 2026-08-11

Adobe Commerce and Magento are e-commerce platforms used by businesses to build and manage online stores. This vulnerability allows an attacker to bypass authorization controls and gain elevated access to sensitive administrative resources without needing user interaction. An exploit could enable unauthorized account takeover, data theft, or modification of products and orders.

Technologies: [Adobe Commerce](https://junglewise.ai/threats/technologies/commerce), [Adobe Magento](https://junglewise.ai/threats/technologies/magento). Vendors: [Adobe](https://junglewise.ai/threats/vendors/adobe).

## Quick answers

**Is CVE-2026-71362 exploited in the wild?** Yes. CVE-2026-71362 is known to be exploited in the wild, first recorded on 24 September 2026. Treat it as urgent.

**How severe is CVE-2026-71362?** Critical severity, with a CVSS score of 9.1, published 11 August 2026.

**Which products and versions are affected?** Adobe Adobe Commerce; Adobe Magento.

**Is there a fix for CVE-2026-71362?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-71362 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-71362?** Check whether you run Adobe Commerce or Adobe Magento. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is an incorrect authorization flaw in Adobe Commerce and Magento that allows attackers to bypass access controls and obtain elevated privileges. The vulnerability does not require user interaction, meaning an attacker can exploit it directly against vulnerable instances. The attack vector is network-based, suggesting the flaw is reachable remotely. The vulnerability has been actively exploited in the wild, indicating real-world attack campaigns are targeting affected systems. Patches should be applied immediately to all affected Commerce and Magento installations.

## Affected products

- Adobe Adobe Commerce
- Adobe Magento

## Timeline

- 2026-09-24: disclosed
- 2026-09-24: exploited

## Related threats

- [Adobe Commerce improper input validation in file write](https://junglewise.ai/threats/cve-2026-95631-adobe-commerce-is-affected-by-an-improper-input-validation)
- [Adobe Commerce improper input validation in security feature](https://junglewise.ai/threats/cve-2026-95630-adobe-commerce-is-affected-by-an-improper-input-validation)
- [Adobe Commerce stored XSS vulnerability in form fields](https://junglewise.ai/threats/cve-2026-92922-adobe-commerce-is-affected-by-a-stored-cross-site-scripting-xss)
- [Adobe Commerce stored XSS in form fields](https://junglewise.ai/threats/cve-2026-92911-adobe-commerce-is-affected-by-a-stored-cross-site-scripting-xss)
- [Adobe Commerce incorrect authorization security feature bypass](https://junglewise.ai/threats/cve-2026-92910-adobe-commerce-is-affected-by-an-incorrect-authorization)