On September 24, 2026, Canada’s Cyber Centre reported that CISA had added CVE-2026-71362 to its KEV catalog. The incorrect-authorization flaw affects Adobe Commerce and Magento Open Source. Bulletin APSB26-92 also covers fixes for Adobe Commerce B2B, but that does not mean this CVE applies to B2B. Sansec reported attempts after the fix was released; the later KEV listing confirms that the vulnerability was exploited.
For a store, the risk is not limited to the storefront: accounts, orders and administration functions can contain sensitive data and access. Adobe’s bulletin remains the source of truth for exact versions and fixes.
What Adobe fixed
APSB26-92 describes CVE-2026-71362 as an incorrect-authorization flaw (CWE-863), scored CVSS 9.1, that can enable privilege escalation without authentication or user interaction. When it published the bulletin on August 11, Adobe said it was not aware of in-the-wild exploitation for the issues it fixed. Sansec later reported that its firewall was blocking attempts against this flaw; BleepingComputer and SecurityWeek covered those observations. Sources for this CVE name Adobe Commerce and Magento Open Source; other products in the bulletin have their own vulnerabilities.
A vulnerable store is not automatically compromised, but it should be treated as a priority when exposed and listed in the bulletin.
The KEV signal
The Canadian advisory says public reports indicated exploitation and that CISA added the CVE to KEV on September 24. The cited sources do not provide a complete list of affected stores, so separate confirmed exploitation from impact on your installation.
That distinction avoids falsely reassuring a vulnerable store while avoiding an unsupported claim of customer-account takeover.
Checking the store
Inventory Commerce, B2B or Magento versions, extensions and administration exposure. Apply the APSB26-92 fix for this CVE, then install the latest security update as well. Adobe’s October 13 APSB26-153 covers current Commerce and Magento releases; check the version and Adobe instructions for your branch, including the CVE-2026-75650 hotfix Adobe mentions. Confirm the fixes reached every application node.
Preserve web and administration logs. Look for new accounts, privilege changes, configuration edits, unusual orders and sign-ins from unexpected locations.
Accounts and secrets
If suspicious activity is confirmed or plausible, reset administrator accounts and rotate integration keys, payment secrets or hosting access according to scope. Review sensitive customer accounts without forcing a global reset without evidence.
Treat urgent payment or reset requests after patching carefully: a compromised store can support highly personalised phishing. For a documented process to manage accounts and secrets, read the SMB password policy guide.
The Soclyde connection
Soclyde does not patch Adobe Commerce or verify a store’s orders and accounts. It can help organise administrative and integration access after rotation by generating unique secrets and storing them in local-first encrypted vaults.
That reduces credential copies in crisis conversations without replacing application review or payment-provider controls.
Key takeaways
CVE-2026-71362 has been exploited and affects specific Adobe Commerce and Magento Open Source versions. Check inventory, apply APSB26-92 for CVE-2026-71362 and the current APSB26-153 update, review accounts and logs, and rotate secrets when needed. Read the secure password generator guide or contact Soclyde.
