CVE-2026-92908: Adobe Commerce | Incorrect Authorization (CWE-863)

Severity: high (CVSS 8.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-13 · updated 2026-10-15
Weakness: CWE-863

Description

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction.

Affected products

Adobe Commerce: through 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep
Adobe Commerce: through 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep
Adobe Magento Open Source: through 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep

References

https://www.adobe.com/trust/security/products/commerce/apsb26-153.html

Get alerted when CVE-2026-92908 or the next vulnerability affects your stack