CVE-2026-71362Vulnerability
Adobe Commerce and Magento Incorrect Authorization Vulnerability
Reported by 7 independent sources · first reported by Check Point Research · last reported
Last reported 12 days ago
Fix due 27 Sep 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 21 Oct 2026
What the reports say
7 reports, newest first · the exact sentence from each-
September 2026 CVE Landscape“CVE-2026-71362”
-
Risky Bulletin: Intel ends paid bug bounties“CVE-2026-71362 Adobe Commerce and Magento Incorrect Authorization”
-
U.S. CISA adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog“CVE-2026-71362 Adobe Commerce and Magento Incorrect Authorization Vulnerability”
-
WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV“CVE-2026-71362 (CVSS score: 9.1) - An incorrect authorization vulnerability in Adobe Commerce and Magento that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.”
-
Adobe security advisory (AV26-808) – Update 2“Open-source reporting indicates that CVE-2026-71362 is being exploited in the wild.”
-
CISA Adds Two Known Exploited Vulnerabilities to Catalog“CVE-2026-71362 Adobe Commerce and Magento Incorrect Authorization Vulnerability”
-
17th August – Threat Intelligence Report“Adobe released a fix for CVE-2026-71362, a critical authentication vulnerability affecting Adobe Commerce and Magento Open Source.”
Indicators reported together
named in the same reportsAlso named with it: CVE-2026-5430, CVE-2026-87902, CVE-2026-65660, CVE-2026-67279, CVE-2026-88771, CVE-2026-88772, CVE-2026-68820, CVE-2026-65400, CVE-2026-60004, CVE-2022-0847, CVE-2026-35273, CVE-2026-85046, CVE-2026-85880, CVE-2026-87491, CVE-2026-48710, CVE-2025-39964, CVE-2026-20316, CVE-2026-39987, CVE-2026-60137, CVE-2026-63030
Thanks — we review every report.