CVE-2026-71362

CriticalCVSS 9.1/10Known exploited (CISA KEV)Last modified Sep 25, 2026

Description

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Aug 11, 2026
Last modified: Sep 25, 2026
Added to CISA KEV: Sep 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-713647.2A path traversal vulnerability was found in AWX's project archive extraction. The project_archive action plugin extracts zip and tar archive CVE-2026-713657.7A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request CVE-2026-713667.7A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, an CVE-2026-713685.1F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected product, unintended CVE-2026-71379.8A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setStorageCfg of the file /cgi CVE-2026-713749.8Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from CVE-2026-713757.4Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Compon CVE-2026-713769.8OS command injection vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 befo CVE-2026-713779.8Command Argument Injection Vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-0 CVE-2026-713784.6ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource CVE-2026-7137910.0The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.CVE-2026-71389.8A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setNtpCfg of the file /cgi-bin