Magento incorrect authorization hits CISA KEV

CISA added CVE-2026-71362 to the Known Exploited Vulnerabilities catalog today (2026-09-24). Adobe published APSB26-92 on 2026-08-11 for Adobe Commerce and Magento Open Source. The Critical row is Incorrect Authorization (CWE-863): privilege escalation with no login and no user click, CVSS 3.1 base 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Federal KEV due date is 2026-09-27. Forensic triage is marked Yes under BOD 26-04. Adobe's August bulletin said it was not aware of exploits in the wild for the issues in that update; CISA's KEV listing is the later exploitation signal. Do not treat Adobe's August wording as a clean bill of health after today.

This is the operator write-up from APSB26-92, Adobe's Experience League KB for that bulletin, CISA KEV catalogVersion 2026.09.24, and NVD. The HOL Guard evidence pack for this CVE, when it lands, is the linked source record; this page is the fix-first summary. Sibling CVEs in the same August bulletin (XSS and other authz rows) share the upgrade train; this article tracks the KEV row only.

What breaks

Adobe rates CVE-2026-71362 Critical. Impact is privilege escalation: an attacker can gain elevated access to sensitive resources without authentication and without user interaction. Reporter credit on the bulletin: 0x0.eth (0x0doteth). Magento storefronts and Adobe Commerce backends that still sit on July 2026 security trains (or earlier) are the pager case, especially internet-facing commerce hosts.

Affected product lines from APSB26-92:

• Adobe Commerce: 2.4.9-2026-jul and earlier, 2.4.8-2026-jul and earlier, 2.4.7-2026-jul and earlier, 2.4.6-2026-jul and earlier, 2.4.5-2026-jul and earlier, 2.4.4-2026-jul and earlier
• Adobe Commerce B2B: 1.5.3-2026-jul and earlier, 1.5.2-2026-jul and earlier, 1.4.2-2026-jul and earlier, 1.3.4-2026-jul and earlier, 1.3.3-2026-jul and earlier
• Magento Open Source: 2.4.9-2026-jul and earlier, 2.4.8-2026-jul and earlier, 2.4.7-2026-jul and earlier, 2.4.6-2026-jul and earlier

Fixed trains named in the bulletin are the matching August 2026 builds (*-2026-aug), including Adobe Commerce through 2.4.4-2026-aug, Magento Open Source through 2.4.6-2026-aug, and matching B2B *-2026-aug builds. Adobe's KB for APSB26-92 also ships Isolated security patch ZIPs for merchants who need a lighter path than a full Composer cycle; Cloud merchants may already receive the same fixes via Magento Cloud Patches. Confirm against the live bulletin and KB for your edition before you close the ticket.

Who is not in scope

• Hosts already on the August 2026 security trains listed in APSB26-92 (*-2026-aug for your Commerce / Magento / B2B line), or that already show CVE-2026-71362 as protected in Adobe's Commerce Version Tool after the August Isolated patch.
• Magento Open Source 2.4.5 / 2.4.4 lines for this specific bulletin row. APSB26-92 lists those trains under Adobe Commerce only, not under Magento Open Source.
• Other Adobe products outside Commerce / Magento Open Source / Commerce B2B named in APSB26-92. This KEV row is not a free pass to ignore unrelated Adobe bulletins, but it is not their vulnerability either.
• Prior Magento stories already on this blog (StyleSmuggler template RCE CVE-2026-75650, APSB26-138 authz CVE-2026-77774). Different CVEs, different upgrade trains. Do not treat those posts as coverage for 71362.

One operator check

From the Commerce / Magento project root, print the installed product version, then ask Adobe's patch-status tool whether CVE-2026-71362 is protected (CVT ships with the July 2026 Isolated patch train per Adobe's KB):

php bin/magento --version
php vendor/bin/patch-status --version
php vendor/bin/patch-status

Read applied_patches, missing_patches, and the per-CVE vulnerability_status for CVE-2026-71362 (PROTECTED / VULNERABLE / UNKNOWN). If patch-status is missing, you are not on a train that already pulled CVT; apply the July Isolated patch first per Adobe's KB, then re-run. Cloud-only alternative from the same KB: Quality Patches Tool status for the August Isolated patch id that matches your line.

How to fix

Move every affected Commerce / Magento / B2B install onto the August 2026 security train for your line (examples from APSB26-92: 2.4.9-2026-aug … 2.4.4-2026-aug for Adobe Commerce; Magento Open Source through 2.4.6-2026-aug; matching B2B *-2026-aug). Prefer the path your ops already use:

1. Composer / full security update when Adobe publishes packages for your line, or you are already on a Composer-based monthly security workflow.
2. Isolated security patch ZIP from Adobe's APSB26-92 KB when your line is classified as Isolated-only for August 2026 (Adobe notes Composer packages were not published alongside several of those trains). Apply July's Isolated patches first; August builds on July and must be applied in order. Example zip names from the KB include 2-4-9-aug-2026.zip, 2-4-8-p5-aug-2026.zip, 2-4-7-p10-aug-2026.zip, 2-4-6-p15-aug-2026.zip, and composer-key-gated zips for older Commerce lines.
3. Adobe Commerce on Cloud: pull the latest Magento Cloud Patches / cloud-patches update that includes APSB26-92. Adobe warns that stacking the Isolated ZIP on top of an already-patched cloud-patches install can fail.

After the update, re-run php vendor/bin/patch-status and confirm CVE-2026-71362 is PROTECTED. Federal agencies under BOD 26-04 also owe forensic triage before or with the patch window; the KEV due date is 2026-09-27.

What this is not

This is not a remote code execution bug in the Adobe table for CVE-2026-71362, and it is not a first-day disclosure story: APSB26-92 shipped 2026-08-11. Availability impact is listed as None in the CVSS vector. Treat it as unauthenticated privilege escalation that CISA now says is known-exploited, on a widely deployed commerce stack.

References

• Adobe APSB26-92
• Adobe Experience League: Security update APSB26-92 (Isolated patches / CVT)
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-71362, dateAdded 2026-09-24, dueDate 2026-09-27, BOD 26-04)
• NVD CVE-2026-71362
• GitHub Advisory GHSA-f58v-hxr9-8947 (unreviewed mirror of the CVE record)