Adobe has disclosed a critical (CVSS 9.8) incorrect authorization flaw in Adobe Commerce, Adobe Commerce B2B and Magento Open Source. Adobe says successful exploitation could result in arbitrary code execution, and that exploitation does not require user interaction.
What Is It
CVE-2026-92909 is an Incorrect Authorization vulnerability (CWE-863) in Adobe Commerce. Adobe says that successful exploitation could result in arbitrary code execution in the context of the current user. Exploitation does not require user interaction.
Adobe PSIRT published the CVE on October 13, 2026. NVD lists its status as "Awaiting Analysis," so NVD has not yet completed its own enrichment.
Why It Matters
Adobe scores the flaw at CVSS 3.1 9.8 (CRITICAL), with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That vector means:
- It can be exploited over the network.
- Attack complexity is low.
- No privileges are required.
- No user interaction is required.
- Confidentiality, integrity and availability impact are all high.
Adobe rates the flaw as remotely reachable, with no privileges required and possible code execution. That makes it a high-priority patch for any internet-facing storefront.
Exploitation status: As of publication, this CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. CISA has not confirmed active exploitation.
What's Vulnerable
Adobe lists these products and versions as affected:
- Adobe Commerce: 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep and earlier
- Adobe Commerce B2B: 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep and earlier
- Magento Open Source: 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep and earlier
Patch Status
Adobe lists these versions as unaffected:
- Adobe Commerce: 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-oct
- Adobe Commerce B2B: 1.5.4-alpha1, 1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, 1.3.3-2026-oct
- Magento Open Source: 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct
Update to the October 2026 release for your branch, and follow the guidance in Adobe security bulletin APSB26-153. Because the CVE is not in the KEV catalog, CISA has set no required action or due date for it.