Adobe Commerce privilege escalation exploited (CVE-2026-71362) [PoC]

Actively exploited in the wild - CVE-2026-71362 is a critical incorrect authorization flaw in Adobe Commerce (Magento) that grants unauthenticated attackers elevated access to sensitive resources through privilege escalation. Adobe has released a fix; apply it immediately.

Overview

CVE-2026-71362 is an incorrect authorization vulnerability in Adobe Commerce, the e-commerce platform also known as Magento. The software fails to properly verify that a requesting user is authorized to perform certain operations, allowing an attacker to bypass access controls and gain privileges they should not have. Because the flaw sits in the authorization layer rather than requiring valid credentials, it can be triggered remotely over the network with no authentication and no user interaction.

Adobe Commerce powers storefronts and admin backends that hold customer records, order data, payment integrations, and often deep connections into inventory and ERP systems. An attacker who escalates privileges here can reach administrative functions, read or modify sensitive data, and potentially pivot further into the business.

Impact

A successful exploit gives the attacker elevated access to sensitive resources. In practice this means reaching data and functionality reserved for privileged accounts: customer personally identifiable information, order and payment metadata, administrative configuration, and API credentials stored in the platform. Because exploitation requires no user interaction and no valid login, the attack surface is any internet-facing Commerce instance that has not been patched. The CVSS score of 9.1 reflects the low complexity, network attack vector, and the fact that no privileges or interaction are needed.

CISA has added this CVE to its Known Exploited Vulnerabilities catalog, confirming that real-world attacks are underway. The EPSS score sits at roughly 2.3 percent for the next 30 days, but the confirmed exploitation status matters far more than the probability estimate.

Remediation and Mitigation

• Apply Adobe’s security update for Adobe Commerce immediately. Adobe publishes patched versions through its security bulletin; install the latest release for your Commerce line.
• If you cannot patch on short notice, restrict administrative and API access to trusted IP ranges and place the admin panel behind a VPN or zero-trust gateway.
• Audit logs for unexpected privilege changes, new admin accounts, or unfamiliar API activity, and rotate any credentials that may have been exposed.
• Deploy a web application firewall with virtual patching rules that block the known exploitation pattern while you stage the update.
• Check for indicators of compromise across web server logs, application logs, and outbound network connections.

Security Insight

This case is a reminder that authorization bugs in commerce platforms are often more dangerous than remote code execution scares, because the platform legitimately holds the data attackers want. Adobe Commerce has a long history of access-control flaws, and this one landing in CISA’s exploited catalog shows attackers now treat e-commerce backends as a primary target rather than an opportunistic one. Organizations that patch slowly and expose admin endpoints directly to the internet carry the most risk. For ongoing coverage of exploited vulnerabilities, see our security news and breach reports.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs