CVE-2026-71362 is a critical security vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source, platforms used by retailers, manufacturers, distributors, and other organizations to operate customer-facing digital commerce. The issue can allow an external attacker to obtain elevated access to sensitive application resources without needing a user to click a link, open a file, or otherwise participate.
For organizations across the United States and Canada, this matters because an online storefront is not simply a sales channel. It is often connected to customer records, order workflows, inventory systems, payment services, marketing platforms, and business operations. A security weakness in that environment can create operational disruption and put trust, contractual obligations, and compliance commitments at risk.
This article explains the vulnerability in business terms, outlines practical exposure indicators, and provides response priorities. A technical appendix offers security and information technology teams guidance for verification, remediation, and longer-term hardening. Adobe has issued updates, and public-sector advisories report that the vulnerability has been exploited in the wild.
Adobe published Security Bulletin APSB26-92 on August 11, 2026, covering CVE-2026-71362 in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The issue was reported to Adobe by security researcher 0x0.eth, also known as 0x0doteth. It is categorized as an incorrect authorization vulnerability, meaning the platform can fail to enforce the access limits that should prevent unauthorized parties from reaching protected functions or resources.
Adobe assigned the vulnerability a Critical severity rating with a Common Vulnerability Scoring System score of 9.1 out of 10. The National Vulnerability Database published the record on August 11, 2026, and identifies the weakness as CWE-863, Incorrect Authorization.
The timeline became more urgent in September. The Canadian Centre for Cyber Security reported open-source indications of exploitation in the wild, and stated that the U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-71362 to its Known Exploited Vulnerabilities catalog on September 24, 2026. That progression means affected organizations should treat remediation as a near-term business priority, not a routine maintenance item.
If your organization operates an affected Adobe Commerce or Magento environment, this vulnerability could enable an attacker to gain access beyond what they should be allowed to have. In practical terms, elevated access may expose business-sensitive functions and data that support your online operations. Because exploitation does not require customer or employee interaction, awareness training alone does not address the immediate risk.
The operational impact can include disruption to online ordering, unexpected changes to store configuration, fraudulent activity, and emergency investigation work during high-revenue periods. If your storefront connects to customer data, loyalty programs, business-to-business accounts, fulfillment partners, or financial systems, an incident can have effects beyond the web application itself.
For U.S. and Canadian businesses, the consequences may also include notification assessments, contractual review, payment-provider scrutiny, and questions from regulators or enterprise customers. Even when payment card data is handled by a third-party processor, exposed customer information, account details, order histories, or administrative capabilities can still create significant legal, commercial, and reputational exposure.
The business response should be proportionate but prompt: determine whether you operate an affected version, apply Adobe’s official security update, preserve appropriate evidence, and validate that the remediation worked. Do not assume a web application firewall, managed hosting provider, or cloud platform has already resolved the underlying application issue.
Regional Bank: A regional bank uses Adobe Commerce for branded merchandise, customer promotions, and event registration. An attacker who gains elevated access could alter storefront content or access information associated with customer orders, forcing the bank to suspend the service and begin a costly investigation. The organization may also face customer trust concerns because the incident occurred on a digital channel carrying its brand.
Mid-Market Manufacturer: A manufacturer uses Adobe Commerce B2B for dealer pricing, parts ordering, and account-specific product catalogs. Unauthorized elevated access could expose commercially sensitive pricing or disrupt purchasing workflows for distributors. The result could be delayed shipments, strained channel relationships, and lost revenue during a critical sales period.
Canadian Retailer: A multi-province retailer uses Magento Open Source for online sales and connects it to inventory, customer-support, and email-marketing tools. If the commerce platform is compromised, the retailer may need to investigate whether customer contact information or purchase histories were exposed. That can trigger privacy and notification reviews, along with public-facing communications that affect loyalty.
Small Direct-to-Consumer Brand: A growing online brand relies on a lean technology team and a managed hosting partner. A successful attack could require the company to take the storefront offline while it restores confidence in the environment. For a business dependent on daily online sales, even a short disruption can affect advertising efficiency, fulfillment planning, and customer retention.
A patch closes a known weakness, but it does not automatically establish whether your environment was exposed before remediation or whether other pathways remain. IntegSec helps organizations evaluate the security of customer-facing applications, identity controls, integrations, and cloud infrastructure through focused penetration testing and practical risk reduction.
If you operate Adobe Commerce or Magento in the United States or Canada, engage IntegSec to validate your exposure, test the effectiveness of your controls, and prioritize the changes that reduce business risk. Learn more or start a conversation at IntegSec.
CVE-2026-71362 is an incorrect authorization issue, classified as CWE-863, affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. Adobe’s advisory describes the impact as privilege escalation: an attacker can obtain elevated access to sensitive resources because authorization controls do not correctly enforce intended access restrictions.
Adobe assigned a CVSS v3.1 base score of 9.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. The vector indicates a network-reachable attack path with low attack complexity, no prerequisite privileges, and no user interaction. Confidentiality and integrity impacts are rated High, while availability impact is rated None.
The National Vulnerability Database record confirms the issue can permit elevated access to sensitive resources and notes that exploitation requires no user interaction. As of the available NVD record, the vulnerability is associated with Adobe Commerce product configurations and affected versions are addressed by the August 2026 releases.
Version enumeration should begin with each deployed Commerce codebase, including production, staging, preproduction, disaster recovery, and separately managed regional storefronts.