CriticalCVSS9.12026-09-26
CVE-2026-71362 — Unauthenticated privilege escalation in Adobe Commerce and Magento (explainer and fix)
Incorrect authorization in Adobe Commerce / Magento Open Source (CWE-863, CVSS 9.1, no authentication). The fixed '2026-aug' releases have been out since 11 August, but CISA confirmed exploitation and added it to KEV on 24 September. This site's view: stores that deferred it because the bulletin said 'priority 2, no known exploits' are the most exposed. Patching is step one; checking whether you were entered while unpatched is part of the job.