CVE-2026-71362
Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.
- Record
CVE-2026-71362- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2026-56844
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.
- Record
EUVD-2026-56844- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-f58v-hxr9-8947
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in...
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.
- Record
GHSA-f58v-hxr9-8947- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
CISA KEV No score
Adobe Commerce and Magento Incorrect Authorization Vulnerability
Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.
- Record
CVE-2026-71362- Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.
- Record
CVE-2026-71362- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSV
Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.
- Record
CVE-2026-71362- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVROOT-APP-COMPOSER-CVE-2026-71362 No score
CVE-2026-71362 in magento/product-enterprise-edition - Patched by Root
Root has patched CVE-2026-71362 in the magento/product-enterprise-edition package for Root:Composer. Multiple fixed versions available.
- Record
ROOT-APP-COMPOSER-CVE-2026-71362- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
magento/product-enterprise-editionRoot:Composer |
before 2.4.8-p512007004+root.io | 2.4.8-p512007004+root.io2.4.7-p1012007004+root.io2.4.8-p512007005+root.io2.4.7-p1012007005+root.io2.4.7-p1012007006+root.io2.4.8-p512007006+root.io |
magento/product-community-editionRoot:Composer |
before 0.74.0-beta2-p12007004+root.io | 0.74.0-beta2-p12007004+root.io2.4.7-p1012007004+root.io2.3.1-p12007004+root.io2.4.8-p512007004+root.io2.3.1-p12007005+root.io2.4.7-p1012007005+root.io0.74.0-beta2-p12007005+root.io2.4.8-p512007005+root.io |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | dinosn/cve-2026-71362-magento-lab | 2026-08-15 |
| PoC in GitHub | mahumadad/cve-2026-71362-magento-ato | 2026-10-23 |
| Nuclei | Adobe Commerce/Magento - Customer Session Identity Switch |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-71362 is a critical vulnerability (CVSS 9.1) in Adobe Commerce, published August 11, 2026. CISA lists it as known to be exploited, since September 24, 2026. EUVD reports exploitation since September 24, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 90.5%, the 99th percentile. Fixed in magento/product-enterprise-edition 2.4.8-p512007004+root.io.