Summary
- CVE-2026-71362 is an incorrect-authorisation flaw with a CVSS score of 9.1.
- Exploitation requires neither authentication nor administrative privileges and does not require user interaction.
- Adobe has issued fixed August releases; there is no confirmed in-the-wild exploitation in the evidence reviewed.
Adobe has patched a critical authorisation flaw in Commerce and Magento Open Source that can be exploited without an existing account or administrator privileges, placing internet-facing ecommerce environments within the affected footprint.
CVE-2026-71362 is an incorrect-authorisation vulnerability carrying a CVSS score of 9.1. Adobe says no authentication is required, administrator privileges are not needed and exploitation requires no user interaction.
The company issued updated August builds for supported Adobe Commerce, Adobe Commerce B2B and Magento Open Source branches on 11 August. The wider APSB26-92 bulletin also addresses stored cross-site scripting and additional authorisation weaknesses with varying exploitation prerequisites.
The absence of an authentication requirement gives CVE-2026-71362 a different operational profile from vulnerabilities that assume a compromised customer or administrative account. An attacker able to reach a vulnerable commerce environment can interact with the flawed authorisation path before obtaining legitimate credentials.
Adobe classifies the impact as privilege escalation rather than describing the vulnerability as a direct database compromise. The distinction is relevant because the ultimate consequence depends on which application privileges can be obtained and how an individual Commerce deployment connects to order processing, customer information and internal systems.
Ecommerce platforms occupy a sensitive business position regardless of that distinction. They combine internet exposure with revenue generation, customer identities, order histories and extensive integrations into payment, logistics, marketing and inventory systems.
Commerce deployments can also be operationally difficult to patch quickly. Organisations often run custom themes, extensions and integrations that require testing against a new release, while an unsuccessful update can affect checkout or other revenue-critical functions. That creates a conflict between change assurance and reducing the period of exposure.
The August bulletin does not remove the need for that testing, but unauthenticated vulnerabilities increase the cost of delay. A risk decision based purely on the inconvenience of a maintenance window can miss the fact that an exposed Commerce server is already designed to accept requests from untrusted users on the internet.
European retailers have an additional data-governance consideration because authenticated access may expose personal information even where the underlying flaw is not itself described as a data-exfiltration vulnerability. Account histories, addresses, customer-service information and other records can turn an application-security incident into a personal-data assessment.
Patch prioritisation therefore depends on the platform’s reachability, installed version, business criticality and integration architecture as well as the headline severity score. Commerce installations that are publicly reachable and contain customer accounts sit differently from an internal application using the same vulnerable component.
Adobe provides fixed versions through the APSB26-92 security bulletin, allowing operators to map their installed branch to the relevant August release.
No confirmed attack campaign is established in the evidence reviewed for this version of the article. The current position is therefore a high-severity, unauthenticated weakness with public vendor updates rather than a confirmed breach wave.
