CVE-2026-92908
Adobe Commerce | Incorrect Authorization (CWE-863)
At a glance Severity HIGH 8.3 EPSS EPSS 0.60 % · percentile 49 (2026-10-27) State PUBLISHED Published 2026-10-13 Updated 2026-10-15 Assigner adobe NVD status Awaiting Analysis Description Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction.
Scores Version Score Vector Scored by CVSS 3.1 HIGH 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L adobe CVSS 3.1 HIGH 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L NVD · psirt@adobe.com (Secondary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected products Product Versions Adobe · Adobe Commerce affected 0 ≤ 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep ; unaffected 2.4.10-alpha1,2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-oct Adobe · Adobe Commerce B2B affected 0 ≤ 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep ; unaffected 1.5.4-alpha1,1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, 1.3.3-2026-oct Adobe · Magento Open Source affected 0 ≤ 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep ; unaffected 2.4.10-alpha1,2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct
References
Sources
