tag
Magento
2 articles with this tag
CriticalCVSS9.12026-09-26
CVE-2026-71362 — Unauthenticated privilege escalation in Adobe Commerce and Magento (explainer and fix)
Incorrect authorization in Adobe Commerce / Magento Open Source (CWE-863, CVSS 9.1, no authentication). The fixed '2026-aug' releases have been out since 11 August, but CISA confirmed exploitation and added it to KEV on 24 September. This site's view: stores that deferred it because the bulletin said 'priority 2, no known exploits' are the most exposed. Patching is step one; checking whether you were entered while unpatched is part of the job.
CriticalCVSS9.32026-06-08
CVE-2026-45247 — unauthenticated RCE in a Magento extension via PHP object injection
PHP object injection (CWE-502) in Mirasvit Full Page Cache Warmer for Magento 2 before 1.11.12 reaches unauthenticated RCE. CVSS 9.3. The main fix is updating to 1.11.12+. The root rule: never deserialize untrusted data.