CVE-2026-71362: listed in the CISA KEV catalog

CVE-2026-71362 · CVSS 9.1 CRITICAL · KEV 2026-09-24 · patch available

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.

Is CVE-2026-71362 exploited?

• Listed in the CISA KEV catalog on 2026-09-24.
• Federal remediation due 2026-09-27.
• Past that date by 47 days.
• Public exploit code: none found in monitored sources.
• Public detection rules exist.

Which products and versions are affected?

• Adobe · Adobe Commerce · 0 - 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug
• Adobe · Adobe Commerce B2B · 0 - 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul
• Adobe · Magento Open Source · 0 - 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul

Is there a patch?

Yes. Update to one of these or later:

From Adobe's CVE record · Adobe advisory

What PlainSec published about CVE-2026-71362

• Adobe Commerce account flaw drew attacks after disclosure (2026-08-16)

Primary sources

• NVD record
• CISA KEV catalog
• Adobe advisory
• Nuclei template

What this record does not say

• No EPSS score.

KEV and EPSS are re-checked daily. Record last updated 2026-10-18.