CVE-2026-71362

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.

CVSS

9.1

EPSS

0.023 (82.8th percentile)

CISA KEV

Added 2026-09-24, due 2026-09-27

Exploitation

active

Public exploits

1 repositories

State

PUBLISHED

Coverage

• ● Actively exploitedCritical 100CISA advisories & alerts24 Sept, 12:00

  CISA Adds Two Known Exploited Vulnerabilities to Catalog

  CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability CVE-2026-71362 Adobe Commerce and Magento Incorrect Authorization Vulnerability These types of…

  ↗cisa.gov/news-events/alerts/2026/09/24/cisa-add…(opens the publisher's site in a new tab)

What we observed

1. 24 Sept, 19:10poc publishedpoc-in-github
2. 24 Sept, 19:10kev addedcisa-kev