Act nowDisclosed

Advisory · CVE-2026-92909

Authorization flaw in Adobe Commerce allows unauthenticated code execution

Adobe Commerce checks authorization incorrectly in a path an unauthenticated attacker can use to execute arbitrary code. Adobe rates it CVSS 3.1 9.8.

Advisory published October 13, 2026Independent summary
Vendor
Adobe
Product
Adobe Commerce
Identifier / CWE
CVE-2026-92909
CWE-863
Action timing
Immediate
ELI5

Explain it like I’m five

A door in the store that should have asked who you are simply does not, and behind it sits code execution.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01No login needed

    An unauthenticated attacker reaches the affected Commerce function.

  2. 02Authorization skipped

    The incorrect authorization check lets the request through as if it were permitted.

  3. 03Code executes

    The attacker runs arbitrary code in the application's context.

What happened

Adobe disclosed CVE-2026-92909 in bulletin APSB26-153. An incorrect authorization vulnerability (CWE-863) in Adobe Commerce, Commerce B2B, and Magento Open Source can be used by an unauthenticated attacker to execute arbitrary code, with no user interaction.

Adobe’s affected data covers Commerce and Magento Open Source release lines through the September 2026 updates, with the October 2026 updates listed as unaffected. Apply the APSB26-153 update for your release line.

What to do

  1. Inventory every Adobe Commerce deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Adobe Commerce while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for requests to admin or API endpoints from unfamiliar sources, new admin users, and files added outside release processes.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Unauthenticated code execution in a payment-handling platform is as urgent as it gets. Patch first, then assume exposure and hunt.