Critical Auth Flaw in Adobe Commerce Lets Attackers Run Code

Remote attackers can now execute arbitrary code on systems running specific versions of Adobe Commerce and Magento Open Source. This capability stems from an incorrect authorization vulnerability identified as CVE-2026-92909. According to the National Vulnerability Database, the issue carries a CVSS score of 9.8, classifying it as critical. Exploitation does not require any interaction from a legitimate user, allowing an adversary to act entirely remotely.

In plain English

The vulnerability allows an attacker to bypass security checks that should prevent unauthorized actions. Instead of needing to log in or trick a user into clicking a link, the attacker can send a request directly to the server. The system incorrectly accepts this request as valid. Once accepted, the attacker can run their own code on the server. This code runs with the same permissions as the user account the application is using.

The background

Adobe Commerce and Magento Open Source are widely used platforms for online stores. Many businesses rely on these tools to manage products, customers, and transactions. The affected versions span several recent releases, including Adobe Commerce up to 2.4.9-2026-sep and Adobe Commerce B2B up to 1.5.3-2026-sep. Magento Open Source versions up to 2.4.9-2026-sep are also impacted. The specific weakness is categorized under CWE-863, which relates to incorrect authorization logic.

What changes now

Organizations using these platforms must verify their current software versions immediately. If their installation matches any of the listed affected versions, they are exposed to remote code execution. Security teams should prioritize scanning their infrastructure for these specific release numbers. Since no patch or fix has been confirmed in the source material, teams cannot yet apply a vendor-provided update. Operational focus shifts to monitoring for unusual activity and restricting access where possible.

What made it possible

Incorrect authorization flaws occur when software fails to properly verify if a user has the right to perform a specific action. In intrusion scenarios, this weakness typically serves as the initial access or privilege escalation stage. Attackers exploit these gaps to gain a foothold without needing valid credentials. Security operations teams usually monitor for requests that lack proper authentication tokens or that come from unexpected sources. Checking whether application logic enforces strict permission checks on every sensitive endpoint is a standard defensive measure for this class of vulnerability.

What to do and how to stay safe: Adobe Commerce

• Verify the exact version of Adobe Commerce or Magento Open Source currently deployed in your environment.
• Review server logs for unusual requests or attempts to execute commands from unexpected IP addresses.
• Restrict network access to administrative interfaces and sensitive application endpoints to known, trusted networks.
• Prepare an incident response plan that addresses remote code execution, including isolation procedures for affected servers.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific CVE ID covers this authorization flaw?

The vulnerability is tracked as CVE-2026-92909.

Does exploiting this issue require a user to click a link?

No, exploitation of this issue does not require user interaction.

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates the CVSS score as 9.8.