CISA Adds CVE-2026-71362 in Adobe Commerce and Magento to Actively Exploited List
The U.S. agency CISA lists a critical vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source as actively exploited. Patches have been available since August.
CVE-2026-71362 in Adobe Commerce was added to the U.S. agency CISA’s Known Exploited Vulnerabilities (KEV) catalog on September 24, 2026. The listing means CISA has confirmed exploitation of this vulnerability in the wild. The flaw affects Adobe Commerce, Adobe Commerce B2B and Magento Open Source.
Adobe assigned the vulnerability a CVSS score of 9.1 out of 10. It is an improper authorization flaw classified as CWE-863. According to the vendor, it could allow an attacker to escalate privileges and does not require user interaction.
CVE-2026-71362 Is in the KEV Catalog
The KEV catalog collects vulnerabilities whose exploitation CISA has confirmed. For U.S. federal civilian agencies, CISA set a remediation deadline of September 27, 2026. Although this deadline does not directly apply to commercial e-shops or other private organizations, inclusion in KEV is a reason for operators of affected installations to treat the update as urgent.
Adobe released fixes for the vulnerability on August 11, 2026, in security bulletin APSB26-92. Operators of Adobe Commerce, Adobe Commerce B2B and Magento Open Source should verify that they have deployed the fixed releases listed in the bulletin.
What Is Known About the Exploitation
CISA’s public record does not contain a technical description of the attacks, the scope of the campaign, victim data or indicators of compromise. It is therefore unclear which specific versions or deployments were attacked and what procedure the attackers are using.
In an update to its bulletin on August 18, Adobe stated that it was not aware of exploitation of the vulnerability in the wild. The newer KEV listing supersedes that status with CISA’s confirmation from September 24. However, Adobe has not yet separately confirmed attack details publicly.
Neither a specific public proof of concept nor claims that customer accounts were taken over have been independently verified. Operators should therefore rely on the confirmed information: the flaw is actively exploited, could lead to elevated privileges, and fixes are available.
What Operators Should Check
- Compare the Adobe Commerce, Adobe Commerce B2B or Magento Open Source version in use with the fixed releases in bulletin APSB26-92.
- Deploy available security updates according to Adobe’s instructions.
- Review internet-accessible installations and conduct forensic checks of systems according to their own procedures.
- Monitor for any new information from Adobe or CISA, especially indicators of compromise, technical details and further mitigations.
For e-commerce operations, the key point is that CVE-2026-71362 in Adobe Commerce is no longer merely a critical flaw with a fix available. CISA lists it as an actively exploited vulnerability, while publicly available details about the attacks remain lacking.
Sources
- CISA Known Exploited Vulnerabilities Catalog – Confirms the addition of CVE-2026-71362 to KEV on September 24, 2026, the confirmed exploitation status and the September 27, 2026 remediation deadline.
- Adobe Security Bulletin APSB26-92 – Confirms the affected products and versions, CVSS 9.1, the nature of the flaw, the availability of fixes and Adobe’s original statement from August 18 that it was not aware of exploitation in the wild.
- CIRCL KEV Entry: CVE-2026-71362 – Independently reproduces data from the CISA KEV record, including the date added, remediation deadline and “confirmed exploited” designation.
Verified and updated: 09/25/2026 06:25
