Adobe Commerce, Magento Open Source Hit by Critical Remote Code Execution Flaw
A critical vulnerability in Adobe Commerce and Magento Open Source allows remote code execution without user interaction, affecting multiple versions.
Key points
- The flaw is rated Critical with a CVSS score of 9.8 according to the NVD record.
- Exploitation does not require any user interaction to execute arbitrary code.
- Affected products include Adobe Commerce, Adobe Commerce B2B, and Magento Open Source.
Adobe Commerce and Magento Open Source are affected by a critical security vulnerability that allows for arbitrary code execution. The National Vulnerability Database lists the issue as CVE-2026-92909 with a CVSS score of 9.8. This flaw stems from incorrect authorization checks within the software, creating a severe risk for platforms running these e-commerce solutions.
At a glance
- CVE
- CVE-2026-92909
- Product
- Adobe Commerce
- CVSS
- 9.8 Critical
- Weakness
- incorrect authorization
- Exploited
- No known exploitation
The vulnerability enables an attacker to execute arbitrary code in the context of the current user. According to the NVD record, exploitation of this issue does not require user interaction, meaning an attacker can trigger the flaw remotely. The weakness is categorized under CWE-863, indicating a failure to properly restrict access to sensitive functions or data within the application environment.
Context and Background
The National Vulnerability Database assigns a Critical severity rating to CVE-2026-92909 based on its potential impact and ease of exploitation. With a CVSS score of 9.8, the flaw represents one of the highest possible risk levels for software vulnerabilities. The underlying cause is identified as an incorrect authorization vulnerability, which fails to properly validate user permissions before allowing certain actions to proceed within the system.
This type of vulnerability is particularly dangerous because it bypasses standard security controls that rely on user authentication or interaction. An attacker can exploit the flaw remotely, potentially gaining control over the server or application without needing to trick a user into clicking a link or opening a file. The NVD description emphasizes that the code execution occurs in the context of the current user, which may still grant significant privileges depending on the application's configuration.
Who Is Affected
Multiple versions of Adobe's e-commerce platforms are vulnerable to this exploit. Adobe Commerce is affected in versions up to 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, and 2.4.4-2026-sep. Organizations running any of these specific builds are at risk.
Adobe Commerce B2B is also impacted, with vulnerabilities present in versions up to 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, and 1.3.3-2026-sep. Additionally, Magento Open Source users face exposure in versions up to 2.4.9-2026-sep, 2.4.8-2026-sep, and 2.4.7-2026-sep. Administrators must verify their current installation version against this list to determine if their systems are compromised by the lack of proper authorization checks.
What should you do?
Security teams should immediately audit their Adobe Commerce and Magento Open Source installations to identify if they are running any of the affected versions listed in the NVD record. Organizations should monitor official Adobe security advisories for updates. In the interim, restricting network access to the application and implementing strict firewall rules can help reduce the attack surface while awaiting a vendor patch.
What to do and how to stay safe: Adobe Commerce
- Audit your Adobe Commerce and Magento Open Source versions to check if they fall within the affected ranges listed in the NVD record.
- Monitor official Adobe security channels for the release of a patch or update addressing CVE-2026-92909.
- Implement network segmentation and strict firewall rules to limit external access to your e-commerce platforms.
- Review server logs for any unusual activity or unauthorized code execution attempts that may indicate exploitation.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-92909?
The National Vulnerability Database rates CVE-2026-92909 with a CVSS score of 9.8, which is classified as Critical.
Does exploiting this vulnerability require user interaction?
No, the NVD record states that exploitation of this issue does not require user interaction.
Which Adobe products are affected by this flaw?
Adobe Commerce, Adobe Commerce B2B, and Magento Open Source are all affected by this incorrect authorization vulnerability.
