Adobe Commerce: incorrect authorization (CVE-2026-71362)
An incorrect authorization vulnerability was found in Adobe Commerce (CVE-2026-71362, CVSS 9.1). It can lead to privilege escalation and elevated access to sensitive resources. No user interaction is required. According to our analysis, it is listed in CISA KEV, meaning it is marked as exploited.
Checked in Shield: no
Who is affected
Adobe Commerce is affected. The source does not state which versions are vulnerable. Owners of stores running Adobe Commerce (including Magento-based setups) should treat their sites as potentially affected.
How to check
Confirm whether your site runs Adobe Commerce and which version. Compare it with the official Adobe security bulletin. Review admin panel logs for unexpected accounts or permission changes.
How to fix
Patch status is not stated in the source. Follow the Adobe security bulletin and apply the update as soon as it is released or a fixed version is confirmed.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Affected and fixed versions are not disclosed yet. Source: NVD (CVE-2026-71362).
