What is the CVSS score of EUVD-2026-56844?

EUVD-2026-56844 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.5%.

Which versions of Adobe Commerce are affected by EUVD-2026-56844?

A critical authorization flaw in Adobe Commerce and Magento Open Source (versions 2.4.4-2.4.9 and B2B 1.3.3-1.5.3) allows unauthorized remote access to sensitive business data without requiring…

Is there a public PoC exploit available for EUVD-2026-56844?

Yes, a public proof-of-concept exploit is available for EUVD-2026-56844. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate EUVD-2026-56844?

Within 24 hours: Inventory all Adobe Commerce and Magento Open Source deployments to identify instances running versions 2.4.4 through 2.4.9 or B2B 1.3.3-1.5.3 across all environments. Within 7 days: Restrict network access to affected instances using IP whitelisting for legitimate administrators; deploy enhanced monitoring to detect unusual authorization patterns and API activity; contact Adobe support to confirm patch availability timeline for the August 2026 patch set. Within 30 days: Apply the vendor security patch immediately upon release, verify all instances are updated, and conduct a forensic review for unauthorized access attempts or data exfiltration.

Adobe Commerce EUVD-2026-56844

| CVE-2026-71362 CRITICAL

Incorrect Authorization (CWE-863)

2026-08-11 psirt@adobe.com

GHSA-f58v-hxr9-8947

Authentication Bypass Privilege Escalation Adobe Magento Commerce Commerce B2b

9.1

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Description confirms no user interaction and network-reachable unauthenticated authorization bypass, so AV:N/AC:L/PR:N/UI:N; privilege escalation exposes and alters sensitive resources (C:H/I:H) with no availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Threat Model Generated

Aug 30, 2026 - 19:54 vuln.today

Analysis Generated

Aug 11, 2026 - 19:34 vuln.today

CVE Published

Aug 11, 2026 - 18:18 nvd

CRITICAL 9.1

DescriptionCVE.org

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.

Articles & Coverage 1

News Critical Privilege Escalation in Adobe Commerce & Magento Open Source - CVE-2026-71362 Aug 11, 2026

AnalysisAI

Privilege escalation in Adobe Commerce and Magento Open Source (including Adobe Commerce B2B) lets a remote attacker gain elevated access to sensitive resources through an incorrect authorization flaw, with no user interaction required. All supported branches from 2.4.4 through 2.4.9 (and B2B 1.3.3-1.5.3) prior to the August 2026 patch set are affected, and the CVSS 9.1 rating reflects high confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but as an unauthenticated, low-complexity authorization bypass in a widely deployed storefront platform it warrants urgent patching.

Technical ContextAI

The affected software is Adobe Commerce (formerly Magento Commerce) and its open-source counterpart Magento Open Source, a PHP-based e-commerce platform, along with the Adobe Commerce B2B extension module. The root cause is CWE-863 (Incorrect Authorization): the application performs an authorization check but implements it incorrectly, so an access-control decision that should deny a request instead permits it. In a Magento context this typically maps to a REST/GraphQL API endpoint, admin/customer resource, or ACL-gated action whose permission logic can be reached or satisfied by a principal that should not qualify, allowing access to resources beyond the attacker's intended privilege level.

RemediationAI

Vendor-released patch: upgrade to the August 2026 fixed builds - Adobe Commerce 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, or 2.4.4-2026-aug; Magento Open Source 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, or 2.4.6-2026-aug; and Adobe Commerce B2B 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, or 1.3.3-2026-aug, as directed by Adobe advisory APSB26-92 (https://helpx.adobe.com/security/products/magento/apsb26-92.html). Because this is an unauthenticated authorization bypass and no specific vulnerable feature was disclosed, there is no reliable feature-level workaround; until the patch is applied, compensating controls include restricting access to the admin panel and REST/GraphQL API endpoints via IP allowlisting or a WAF, placing the storefront admin behind VPN or network ACLs, and monitoring for anomalous privileged actions - with the trade-off that WAF rules cannot be precisely tuned without endpoint details and IP restrictions may disrupt legitimate integrations or headless frontends.