Adobe Commerce CVE-2026-71362

No special conditions beyond network reachability - remote unauthenticated exploitation (PR:N/UI:N/AC:L) against affected Adobe Commerce, Magento Open Source, and Adobe Commerce B2B versions prior to the August 2026 patches; the target's storefront or admin/API surface must be reachable by the attacker. Limiting factors: the store must be running an unpatched version in the listed ranges, and impact is confined to confidentiality and integrity (A:N, no availability/denial-of-service effect and no scope change to other systems, S:U). The specific product feature, endpoint, or configuration the flaw resides in was not disclosed in the available data, so environment-specific preconditions cannot be confirmed.

The signals are internally consistent and point to a genuine priority rather than an inflated high-CVSS score: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality and integrity impact, matching the description's statement that exploitation requires no user interaction and yields elevated access. No EPSS score, SSVC decision, KEV entry, or public POC was provided, so exploitation probability cannot be quantified and there is no evidence of active exploitation yet; this is a fix-fast situation driven by exposure and impact, not by observed attacks. The reporter is Adobe PSIRT and the flaw is class-tagged as an authentication bypass and privilege escalation, so any operator running an internet-facing storefront should treat this as urgent regardless of size. The main uncertainty is that no technical detail on the vulnerable endpoint is published, so defenders cannot yet build precise detections and must rely on patching.

An attacker sends crafted requests to an internet-facing Adobe Commerce store's API or admin resource and, exploiting the flawed authorization check, obtains access to data or actions reserved for a higher-privileged role without any credentials or victim interaction. No public exploit is identified at time of analysis, but the network vector and low attack complexity mean a working exploit could be developed quickly once technical details emerge.