Adobe shipped seven fixes for Commerce and Magento on August 11, and five of them are rated Critical — including one, CVE-2026-71362, that needs zero credentials and scores a 9.1. If your store runs Adobe Commerce or Magento Open Source and hasn't pulled the August build, an attacker doesn't need your admin password to start abusing how your store handles requests. They just need your store's URL.
What 'incorrect authorization controls' means for a store owner
In plain terms: a check that's supposed to gate a sensitive action behind a valid admin session doesn't reliably fire. Combine that with a store that's reachable on the open internet — which is the entire point of an online store — and you get a request that should require credentials, succeeding without any. Adobe's own bulletin confirms exploitation requires no privileges and no user interaction, which is the combination that turns a bug into an actual incident fast.
APSB26-92 severity breakdown
Critical5 of 7 bugs
Important2 of 7 bugs
The angle nobody's saying out loud: Adobe rated this Priority 2
Adobe's own severity scale reserves Priority 1 for bugs with confirmed in-the-wild exploitation or an extremely high risk of imminent attack. APSB26-92 shipped as Priority 2, meaning Adobe itself doesn't believe anyone's actively using this yet. My honest take: don't read 'not Priority 1' as 'not urgent.' A 9.1, no-login, low-complexity bug on internet-facing checkout infrastructure is precisely the profile that flips to Priority 1 the moment one researcher reverse-engineers the patch diff — and a platform running this much of mid-size e-commerce is a magnet for exactly that kind of attention.
Adobe Commerce and Magento Open Source power a large share of mid-size online stores — exactly the kind of infrastructure an unauthenticated bug like this puts at risk. · Unsplash
What to actually do this week
Update to the August 2026 build for your branch: 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, or 2.4.4-2026-aug.
If you're still on a pre-2.4.4 branch, you're already outside Adobe's supported range — plan the upgrade, not just this one patch.
Check Adobe Commerce B2B extensions separately; they're called out explicitly in the same bulletin.
Review admin and API access logs for unusual unauthenticated requests since early August.
How this fits the rest of 2026's software mess
'No authentication required' has quietly become the scariest four words in a CVE summary this year — more consistently dangerous, in my experience reading through these bulletins, than flashy zero-days with a nation-state name attached. See Langflow's unauthenticated RCE, Gitea's unauthenticated file-read bug, the Rails Active Storage flaw, and Framework's Metabase breach — four completely different products, same underlying failure: a door that was supposed to be locked, wasn't checking for a key.
Do I need to be logged in as admin for my store to be at risk?
No — that's the entire point of this vulnerability. 'Incorrect authorization controls' means the check that should require an admin session doesn't reliably fire, so an attacker with no credentials at all can reach the affected functionality.
Is Magento Open Source affected, or just paid Adobe Commerce?
Both. Magento Open Source 2.4.6 through 2.4.9 is listed alongside Adobe Commerce 2.4.4 through 2.4.9 in the bulletin.
Has anyone actually exploited this yet?
Adobe says it has no evidence of in-the-wild exploitation as of the August 11 bulletin. Given the bug needs no authentication and the patch diff is now public, that window won't stay open long.
What if I can't upgrade to the August build immediately?
Restrict admin and API endpoints at the network or WAF layer as a stopgap, and monitor logs closely — but this isn't a bug to sit on for a normal patch cycle.
Priority 2 bulletins don't make headlines the way a Patch Tuesday zero-day does, and that's exactly the problem — store owners who only react to 'actively exploited' headlines are going to find out about this one the hard way, from a chargeback report instead of a security advisory.
