Adobe Commerce CVE-2026-71362 Added to CISA KEV: Affected Versions and September 27 Deadline

CISA added Adobe Commerce CVE-2026-71362 to its Known Exploited Vulnerabilities catalog on September 24, 2026, confirming that the authorization flaw has been exploited in the wild. Adobe had already patched the issue in its August Commerce and Magento security releases. CISA lists a September 27 remediation due date for covered federal systems, while private organizations should treat the KEV addition as a strong reason to verify their patch level immediately.

What can CVE-2026-71362 allow?

Adobe classifies CVE-2026-71362 as CWE-863, Incorrect Authorization. Successful exploitation can provide elevated access to sensitive resources that the attacker should not normally be able to reach.

This distinction matters: CVE-2026-71362 is not documented by Adobe as a remote-code-execution vulnerability. TPS therefore does not describe it as RCE.

Is CVE-2026-71362 actively exploited?

Yes. CISA’s KEV listing now establishes that the vulnerability has been exploited in the wild.

That current state is stronger than Adobe’s original August bulletin, which said at publication time that Adobe was not aware of exploitation in the wild. That historical statement described what Adobe knew then; it does not override CISA’s September 24 KEV determination.

Before the KEV addition, security researchers and current security reporting had already described exploitation attempts. Research cited by current coverage said attackers could abuse the authorization flaw to switch customer-session context and reach information belonging to another account. TPS treats that specific attack behavior as researcher-reported rather than wording directly confirmed in Adobe’s advisory.

Which Adobe Commerce builds contain the fix?

Adobe’s CVE data marks the corresponding August 2026 security patch levels as unaffected. Administrators should compare the complete installed build string, not only the base 2.4.x version.

Adobe’s vulnerability data identifies earlier patch levels in those branches as affected. The exact dated patch suffix therefore matters when checking exposure.

Which Adobe Commerce B2B builds contain the fix?

Which Magento Open Source builds are fixed?

Does the September 27 CISA deadline apply to every company?

No. September 27, 2026 is the remediation due date CISA records for covered federal environments under its vulnerability-remediation framework. TPS does not treat that date as a universal legal deadline for every private merchant or ecommerce operator.

The KEV designation is still highly relevant outside government because it establishes known exploitation. Private organizations running affected Commerce or Magento builds should therefore prioritize Adobe’s remediation even when the federal deadline does not directly govern them.

What should Adobe Commerce and Magento administrators do?

Is CVE-2026-71362 the same as CVE-2026-75650?

No. CVE-2026-75650 is a separate Adobe Commerce vulnerability disclosed in September and associated with a different Adobe advisory and emergency remediation. CVE-2026-71362 is the August incorrect-authorization flaw now added to CISA KEV.

The two issues should not be merged merely because both affect Adobe Commerce and have exploitation concerns.

Does CISA say ransomware is using CVE-2026-71362?

No confirmed ransomware linkage was established in the reviewed evidence. CISA’s current KEV data records known ransomware campaign use as Unknown.

TPS therefore does not attribute this vulnerability to ransomware crews or any specific threat actor without stronger evidence.

How many Adobe Commerce stores have been compromised?

No reliable total victim count was established in the reviewed evidence. CISA’s KEV listing confirms exploitation, but it does not establish that every vulnerable Adobe Commerce or Magento installation has been compromised.

TPS also did not verify named victims, a definitive campaign geography or a confirmed threat-actor attribution.

Adobe Commerce CVE-2026-71362: current evidence state

Adobe Commerce CVE-2026-71362: direct answers

What changed on September 24?

CISA added CVE-2026-71362 to the Known Exploited Vulnerabilities catalog, establishing a known-exploited state.

Was a patch already available?

Yes. Adobe had already addressed the vulnerability in its August 2026 security update.

What should administrators verify first?

The complete Commerce or Magento build and dated patch suffix should be checked against Adobe’s fixed August release for that product branch.

Should a patched store assume there was no earlier compromise?

No. Patching closes the vulnerability but does not prove that a previously exposed system was never abused. Where exposure overlapped known exploitation, a defensive compromise review may be warranted.

What could materially change this article?

An Adobe advisory revision, new CISA guidance, confirmed victims, campaign attribution, ransomware linkage, reliable compromise indicators, new patch guidance or evidence that the affected-version boundary changed would materially update the current answer.