your online store's checkout might be one request away from a total takeover — no password needed

Adobe just patched a 9.1 in Commerce and Magento that needs zero credentials to exploit — and it rated the fix Priority 2, not the top tier. Aliteq Priya Nair · Software & Systems Editor

CVE-2026-71362: incorrect authorization controls, exploitable with no authentication at all, CVSS 9.1.

Part of APSB26-92 — 7 vulnerabilities patched August 11, 2026, 5 of them rated Critical.

Affects Adobe Commerce 2.4.4 through 2.4.9 on July 2026 security-update builds or earlier, Magento Open Source 2.4.6–2.4.9, and Adobe Commerce B2B extensions.

Fixed in the August builds — 2.4.9-2026-aug down to 2.4.4-2026-aug depending on your branch.

Adobe says it isn't aware of active exploitation yet, and rated the bulletin Priority 2, not its top urgency tier — but calls prompt patching 'crucial' given the zero-auth, low-complexity path.

Adobe explicitly says it has no evidence of in-the-wild attacks yet. Treat that as a head start, not a pass — Adobe Commerce and Magento Open Source run a meaningful share of mid-size online stores,…

Don't wait for 'actively exploited'

Read the full story

Aliteq your online store's checkout might be one request away from a total takeover — no password needed Read the full story on Aliteq