Incorrect Authorization Vulnerability in Adobe Commerce by Adobe
CVE-2026-92910

7.2HIGH

Key Information:

Vendor

Adobe
Status
Adobe Commerce
Adobe Commerce B2b
Magento Open Source
Vendor
CVE Published:
13 October 2026

What is CVE-2026-92910?

Adobe Commerce is affected by an incorrect authorization vulnerability that allows an attacker to bypass critical security measures. This flaw enables unauthorized read and limited write access without requiring any user interaction. Consequently, it poses significant risks to the confidentiality and integrity of sensitive data. Organizations using affected versions should urgently implement the recommended security measures to safeguard against potential exploitation.

Affected Version(s)

Adobe Commerce 0 <= 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep

Adobe Commerce B2B 0 <= 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep

Magento Open Source 0 <= 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep

References

https://www.adobe.com/trust/security/products/commerce/ap...
vendor-advisory

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.