LIVE · cybersecurity feed
Live wire
ASOS Breach Reveals the Risks in Customer-Facing SaaSUnpatched AhsayCBS flaws exploited to deploy webshells, mine cryptoAI Training Critical as Governance Challenges GrowUS Disrupts Chinese State-Sponsored Hacking ToolsCitrix warns admins to patch new NetScaler RCE flaw immediatelyCisco Patches a Dozen Critical VulnerabilitiesCisco warns of critical flaws allowing Nexus switch takeoverCVE-2026-21589 · Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)Cyber experts call on CISA to create mandatory federal OT rulesGremlin Foresight AI finds system weaknesses and verifies the fixes
cve recordcriticalexploited in the wild3 of 3 cataloguesexploit reported

CVE-2026-71362

Adobe · Commerce and Magento · Adobe Commerce and Magento Incorrect Authorization Vulnerability

Published · Added to CISA KEV
CVSS9.1
Severitycritical
WeaknessCWE-863
EPSS87.5%99.8th percentile
Exploited3 KEV sources
Ransomware useUnknown
Federal fix dueSep 27, 2026

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

patch window

Called exploited 23 days after disclosure.

Measured from the CVE publication date to the earliest of 3 KEV catalogues that list it.

The life of this vulnerability

  1. CVE published
  2. First KEV listing23d
  3. Last KEV listing21d
  4. Last sighting21d

Gaps are compressed to equal steps. The elapsed time is printed under each.

Which catalogues call it exploited

Sources3 of 3
Listings differ by21 d
Strongest claimconfirmed

3 catalogues list it. CIRCL aggregates the others and is shown but not counted.

Public exploitation evidence

1 public report collected from VulnCheck and CIRCL, first on Sep 3, 2026. Each links to its original source. We have not verified them.

Description

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.

Required action (CISA)

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

← Back to the CVE Tracker

Our coverage of CVE-2026-71362

CVE-2026-68820high

17th August – Threat Intelligence Report

Several organizations across various sectors have recently reported cyberattacks and data breaches, while security researchers have detailed new vulnerabilities and emerging threat trends, including the use of AI in cyberespionage.

CVE-2026-58231high

Crooks Buy Expired Domains for Malware Delivery, Other Threats Detailed

Cybercriminals are increasingly acquiring expired internet domains to host malware and execute other malicious activities, according to recent security reports. This tactic leverages previously legitimate domain names, which can lend an air of trustworthiness to their operations.

CVE-2026-71362critical

Critical Adobe Commerce Flaw Exploited After Disclosure

Attackers have begun exploiting a critical vulnerability in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source that could allow unauthenticated account takeovers and access to sensitive customer data. The flaw, identified as CVE-2026-71362, carries a CVSS score of 9.1 and was publicly disclosed by Adobe in its APSB26-92 security bulletin.

CVE-2026-71362

Adobe Commerce Bug Targeted Immediately After Disclosure

Exploitation attempts targeting a recently disclosed vulnerability in Adobe Commerce, identified as CVE-2026-71362, were observed almost immediately following the release of patches by Adobe. This rapid move from disclosure to active targeting highlights a recurring challenge in software security, where threat actors quickly weaponize newly public vulnerability information.

CVE-2026-71362critical

Hackers exploit critical Adobe Commerce flaw to hijack customer accounts

Exploitation attempts have been detected for a critical vulnerability in Adobe Commerce and Magento e-commerce platforms, identified as CVE-2026-71362. This flaw, described as an incorrect authorization vulnerability, could allow attackers to gain elevated access to sensitive resources without authentication, potentially leading to customer account hijackings.