What is the CVSS score of CVE-2026-76202?

CVE-2026-76202 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2026-76202?

Within 24 hours, identify all Adobe Commerce and Magento storefronts running versions 2.4.4 through 2.4.9 (Commerce), 2.4.6 through 2.4.9 (Open Source), or 1.3.3 through 1.5.3 (B2B), and immediately implement Web Application Firewall rules to block privilege-escalation requests and restrict access to admin endpoints by IP whitelist. Within 7 days, conduct a privilege-escalation and data-access audit on affected instances, enable comprehensive API and transaction logging with automated alerts for suspicious authorization patterns, and enforce multi-factor authentication on all administrative accounts. Within 30 days, actively monitor Adobe's security advisories for patch release, schedule urgent upgrades to patched versions once available, and evaluate network segmentation to isolate e-commerce infrastructure from critical business systems and customer databases.

Adobe Commerce CVE-2026-76202

EUVD-2026-74032 HIGH

Incorrect Authorization (CWE-863)

2026-09-08 psirt@adobe.com

GHSA-pjr5-892h-xr3x

Authentication Bypass Privilege Escalation Adobe Magento Commerce Commerce B2b

8.2

CVSS 3.1 · Vendor: adobe

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify Adobe Commerce instance via HTTP fingerprinting
Delivery

Send unauthenticated request to authorization-deficient endpoint
Exploit

Bypass RBAC check (CWE-863)
Execution

Receive elevated-privilege response with sensitive data
Impact

Exfiltrate customer, order, or administrative information

Vulnerability Assessment

Weakness	CWE CWE-863 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Authorization logic validation MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions required - the CVSS PR:N/UI:N/AV:N vector indicates remote unauthenticated exploitation against default network-reachable configurations of Adobe Commerce, Magento Open Source, and Adobe Commerce B2B within the affected version ranges. No specific feature flag, non-default configuration, or authenticated session is documented as a prerequisite. Exploitation is limited to the affected version ranges (Adobe Commerce ≤ 2.4.9-2026-aug, Magento Open Source ≤ 2.4.9-2026-aug, Adobe Commerce B2B ≤ 1.5.3-2026-aug); instances patched per APSB26-138 are not affected. Network reachability to the Commerce instance is the only environmental requirement.
Impact	The CVSS 8.2 High score is driven by the network-reachable, no-authentication, no-interaction vector combined with high confidentiality impact (C:H) and limited integrity impact (I:L), with no availability impact. SSVC reinforces the automated-exploitation concern: the vulnerability is classified as automatable with partial technical impact, which means opportunistic mass-scanning is plausible even without a published exploit. The combination of PR:N and automatable status means that even a mid-sized municipal IT team in gliwice running a public Adobe Commerce storefront would face credible scanning exposure without any sophisticated targeting. EPSS data is not provided in the source intelligence, limiting probabilistic risk estimation; however, the absence of CISA KEV listing and SSVC 'Exploitation: none' together suggest no confirmed in-the-wild abuse at time of analysis. The I:L (limited integrity) and A:N metrics indicate that while information disclosure risk is high, write-side and availability impact are constrained - this is primarily a data-exposure risk rather than a full system compromise path.
Exploit ScenarioDerived	An unauthenticated attacker scans for publicly reachable Adobe Commerce or Magento storefronts, then sends a crafted HTTP request to an endpoint that lacks a proper authorization enforcement check, bypassing RBAC enforcement and receiving a response containing sensitive customer, order, or administrative data. Because no credentials or user interaction are required and the flaw is automatable, the attack is straightforwardly scriptable. No confirmed public exploit code exists at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 08, 2026

Incorrect Authorization in Adobe Commerce allows remote unauthenticated attackers to escalate privileges and access sensitive information without any user interaction. The vulnerability, rooted in CWE-863, affects Adobe Commerce 2.4.4 through 2.4.9, Magento Open Source 2.4.6 through 2.4.9, and Adobe Commerce B2B 1.3.3 through 1.5.3, covering a broad range of production deployments. No public exploit code has been confirmed and CISA KEV does not list active exploitation, but SSVC flags the flaw as automatable, raising concern for mass-scanning campaigns against exposed storefronts.

RemediationAI

Apply Adobe's official patches as documented in security bulletin APSB26-138 (https://helpx.adobe.com/security/products/magento/apsb26-138.html); exact patched version identifiers must be confirmed from the advisory directly, as they follow Adobe's monthly patch-cadence naming scheme and are not enumerated in the available intelligence. As an interim measure before patching, restrict access to the Commerce admin panel (/admin) and API endpoints (REST, GraphQL) via IP allowlisting at the web server or WAF layer - note this does not mitigate exposure if the vulnerable endpoint is on the public storefront path. Enable Adobe Commerce's built-in rate-limiting and deploy a WAF rule set tuned to detect anomalous authorization-bypass patterns (e.g., accessing admin-tier resources without session tokens). Monitor application and access logs for unexpected access to privileged resources or unusual privilege-level transitions.

Affected VersionsENISA

Adobe Commerce B2B 0 ≤1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug

Magento Open Source 0 ≤2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug

Adobe Commerce 0 ≤2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug

Affected Packages

euvd adobe_commerce_0_2_4_9_2026_aug_2_4_8_2026_aug_2_4_7_2026_aug_2_4_6_2026_aug_2_4_5_2026_aug no fix

euvd adobe_commerce_b2b_0_1_5_3_2026_aug_1_5_2_2026_aug_1_4_2_2026_aug_1_3_4_2026_aug no fix

euvd magento_open_source_0_2_4_9_2026_aug_2_4_8_2026_aug_2_4_7_2026_aug no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Adobe Commerce and its open-source counterpart Magento implement role-based access control (RBAC) across storefront, REST/GraphQL API, and admin interfaces. CWE-863 (Incorrect Authorization) indicates the application fails to properly verify whether the requesting entity has sufficient permission before granting access to a restricted resource or operation. The CVSS vector AV:N/AC:L/PR:N/UI:N suggests the flawed authorization check is reachable on a network-accessible endpoint without requiring any prior session or credential - consistent with a missing or improperly enforced gate on a public-facing route. The B2B extension adds additional access-control surfaces (company accounts, shared catalogs, purchase orders) that could widen the attack surface. Affected CPE ranges span Adobe Commerce 2.4.4-2.4.9 and B2B 1.3.3-1.5.3, all marked with the 2026-aug patch cadence identifier in EUVD.

Know when Commerce gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (adobe) PRIMARY 8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI 8.2 HIGH

Network-reachable with no authentication per description and SSVC; C:H for sensitive data access via privilege escalation, I:L for limited write exposure, A:N as availability is unaffected.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

DescriptionCVE.org

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive information. Exploitation of this issue does not require user interaction.

Executive ViewAI

Why It Matters

An authorization flaw in Adobe Commerce and Magento Open Source (versions 2.4.4-2.4.9 and 2.4.6-2.4.9 respectively) enables unauthenticated attackers to escalate privileges and access sensitive customer and business data, directly threatening e-commerce operations and regulatory compliance. The vulnerability is automatable and likely to attract mass-scanning campaigns, though no public exploit code has been identified at time of analysis. With no vendor patch currently available, organizations must deploy interim controls immediately to prevent unauthorized access and data exfiltration.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Implement network-level access controls restricting admin endpoint exposure, deploy Web Application Firewall rules targeting privilege-escalation and authorization-bypass patterns, enforce multi-factor authentication for all administrative accounts, establish comprehensive API and transaction logging with real-time SIEM alerts for failed authorization events, implement strict API rate-limiting and request validation, and segment e-commerce infrastructure from critical databases to limit breach impact.

Threat Intelligence Overview

EPSS Score

0.4%

Top 67% exploitable

Prevalence

High

widely deployed global e-commerce platform, large enterprise and SMB install base

Data Quality

5 sources

Confidence: Medium

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +41

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.