EUVD-2026-99212
GHSA-22xq-66q5-3656
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach internet-facing Commerce endpoint
-
DeliverySend crafted request bypassing authorization
-
ExploitTrigger incorrect authorization check
-
ExecutionAchieve arbitrary code execution
-
ImpactCompromise store data and server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The vendor description specifies no special configuration prerequisite and states exploitation does not require user interaction, consistent with the CVSS vector AV:N/AC:L/PR:N/UI:N - i.e. remote, low-complexity exploitation against network-reachable Adobe Commerce, Adobe Commerce B2B, or Magento Open Source instances. The primary limiting factor is that the description is sparse and references 'the context of the current user,' which may imply an active user session or request context is needed even though the CVSS claims no required privileges; this ambiguity should be confirmed against Adobe APSB26-153. Affected version ranges are not enumerated in the input, so defenders cannot scope exposure precisely without consulting the vendor advisory. |
| Impact | This is a genuine high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges and no user interaction, yielding full confidentiality, integrity and availability impact (C:H/I:H/A:H) for a 9.8 Critical score. The CWE-863 (Incorrect Authorization) classification combined with the vendor's own 'arbitrary code execution' language indicates an authorization bypass that leads directly to RCE - historically the most heavily targeted class of Magento/Adobe Commerce bugs. However, several real-world exploitation signals are MISSING from the input: no EPSS probability is provided, there is no CISA KEV listing, and no public POC is referenced, so this assessment cannot yet confirm active or probable-near-term exploitation. One internal tension to verify: the description states execution occurs 'in the context of the current user,' which implies an existing authenticated user/session, yet the CVSS vector asserts PR:N (no privileges) - this should be verified with Adobe, as it affects whether the flaw is truly pre-authentication. Given Adobe Commerce/Magento's strong track record as an attacker target, treat this as a high priority for patching despite the absence of exploitation telemetry in the provided data. |
| Exploit ScenarioDerived | A remote attacker sends crafted requests to an internet-facing Adobe Commerce or Magento Open Source storefront/admin endpoint, abusing the incorrect authorization check to perform actions they should not be permitted. This bypass is leveraged to achieve arbitrary code execution on the server without any user interaction. No public exploit code is identified at the time of analysis, so exploitation currently requires original research or reverse-engineering of the Adobe patch. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Remote, low-complexity code execution is possible in Adobe Commerce, Adobe Commerce B2B and Magento Open Source through an incorrect authorization flaw (CWE-863) rated CVSS 9.8, allowing an attacker to act with the privileges of the current request context and escalate to arbitrary code execution without user interaction. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes network-reachable exploitation requiring no prior privileges, which is the strongest signal in the available data. No public exploit code and no CISA KEV entry were identified at time of analysis, and Adobe's only provided reference is advisory APSB26-153; defenders should note Adobe's wording about 'the context of the current user,' which may indicate an existing session or request context is required even though the vector claims PR:N.
RemediationAI
No fix version is enumerated in the provided data, so the authoritative fix must be obtained from Adobe advisory APSB26-153 (https://www.adobe.com/trust/security/products/commerce/apsb26-153.html), which lists the patched Commerce, Commerce B2B and Magento Open Source releases; apply that vendor patch as the primary remediation and treat patch status as unconfirmed until the advisory is read, because absence of a version in this feed is not evidence that no patch exists. Until patched, the most effective compensating control is to remove network reachability to the vulnerable surface: restrict /admin, /rest/*, /graphql and B2B company/quote endpoints to trusted IP ranges or a VPN, with the trade-off that legitimate remote administrators and integrations will lose access unless their addresses are allowlisted. If the B2B module is not in active use, disabling it removes an entire CPE-identified attack surface at the cost of losing company accounts, quotes and shared-catalog features. Enforce two-factor authentication and least-privilege admin roles and monitor admin and API logs for unexpected privilege use, accepting that these are detective rather than preventive, and deploy WAF rules blocking anomalous authorization-bypass request patterns while acknowledging that signature-based filtering gives limited protection against a 9.8-severity logic flaw. Because 'the context of the current user' may imply a session prerequisite, also invalidate existing admin sessions and rotate integration and API tokens after patching.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Adobe Commerce and Magento Open Source are PHP-based e-commerce platforms built on the Laminas/Magento framework, exposing extensive network surfaces including the admin panel, REST and GraphQL APIs, and storefront controllers; Adobe Commerce B2B adds company accounts, quotes, purchase orders and shared catalogs on top of the same authorization model. The root-cause class is CWE-863 (Incorrect Authorization): an endpoint performs an authorization decision incorrectly or incompletely, so a caller is permitted to invoke functionality reserved for a higher-privileged role. Because the flaw sits in the authorization layer rather than in a memory-safety or injection primitive, the practical outcome is privilege misuse against existing application logic, and the description states the end effect is arbitrary code execution in the context of the current user. The CVSS vector's PR:N means the scoring assumes no credentials are needed, but the phrase 'context of the current user' creates a real ambiguity: the exploit may still depend on an established session or request context, so the assessed risk should be confirmed against the authoritative vendor advisory before treating every internet-facing instance as directly exploitable without any prerequisite. The supplied CPE entries are version-wildcarded (cpe:2.3:a:adobe:adobe_commerce:*:*, adobe_commerce_b2b, magento_open_source), which means the intelligence feed does not pin down which releases are vulnerable or fixed.
Know when Adobe Commerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-facing e-commerce app with an authorization bypass requiring no privileges or interaction (AV:N/AC:L/PR:N/UI:N) and RCE giving full C/I/A impact; scope unchanged.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.
Articles & Coverage 1
Executive ViewAI
Adobe Commerce, Adobe Commerce B2B, and Magento Open Source are affected by a critical authorization flaw (CVE-2026-92909) that permits an unauthenticated, network-reachable attacker to execute arbitrary code on internet-facing commerce platforms - putting customer records, payment flows, order integrity, and storefront availability directly at risk. No vendor patch is available and no public exploit has been identified at time of analysis, so the exposure window is open-ended and mitigation must be driven by defensive controls rather than a fix. Leadership should treat this as a business-continuity and PCI DSS issue: a compromise of the commerce platform translates into revenue loss, regulatory findings, and lasting customer trust damage.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict or block internet access to admin, B2B, and API endpoints (VPN or allowlist only), deploy WAF/virtual-patching rules for authorization-bypass and remote code execution patterns, disable unused B2B and integration modules, enforce MFA and least privilege on administrative accounts, segment commerce infrastructure from internal networks and backup systems, validate immutable offline backups and restoration, and enable continuous monitoring and alerting on anomalous request-context or privilege-escalation activity. Apply the Adobe APSB26-153 update immediately once it ships.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Adobe Commerce
View allServer-side template injection in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows remote unauthentica
Arbitrary code execution in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plu
SQL injection in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin allows
Security feature bypass in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks plug
Unauthenticated remote code execution affects Adobe Commerce, Adobe Commerce B2B, and Magento Open Source through improp
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Inj
Stored cross-site scripting in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows a remote attacker to p
Stored cross-site scripting (XSS) in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows an attacker who
Arbitrary code execution in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plu
Arbitrary code execution is achievable in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source by an attacker who
Stored cross-site scripting in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source lets a low-privileged authent
Stored cross-site scripting (XSS) in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows an authenticated
Exploit-DB