Adobe Commerce incorrect authorization allows low-privileged read and write access (CVE-2026-92908)

What happened

Adobe Commerce, Adobe Commerce B2B and Magento Open Source are affected by an Incorrect Authorization vulnerability (CWE-863). A low-privileged attacker can exploit the issue over the network with low attack complexity and no user interaction, bypassing security measures to obtain unauthorised read and write access. Availability is affected only to a limited extent.

Adobe rates this CVSS 3.1 score 8.3, high severity. The vector reflects network attack, low privileges required, high confidentiality and integrity impact, and low availability impact. No exploitation or public disclosure is recorded for this issue.

Who is affected

Adobe Commerce versions up to and including 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep and 2.4.4-2026-sep are affected. Adobe Commerce B2B versions up to and including 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep and 1.3.3-2026-sep are affected. Magento Open Source versions up to and including 2.4.9-2026-sep, 2.4.8-2026-sep and 2.4.7-2026-sep are affected. These are internet-facing commerce platforms, so storefront, admin and integration endpoints are commonly reachable from the network.

What to do now

1. Apply the matching fixed release from Adobe's security advisory. Adobe Commerce: 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct or 2.4.4-2026-oct. Adobe Commerce B2B: 1.5.4-alpha1, 1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct or 1.3.3-2026-oct. Magento Open Source: 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct or 2.4.7-2026-oct.

1. If you cannot patch immediately, restrict access to Adobe Commerce admin and integration interfaces, and review low-privileged accounts for unusual read or write activity. Adobe has not stated whether a workaround exists.

How to detect it

Review Adobe Commerce admin and API access logs for unauthorised read or write actions from low-privileged accounts, particularly around catalogue, order or configuration changes. Adobe has not published specific indicators of compromise for this issue.

Beyond the patch

An internet-facing commerce platform is part of your organisation's public attack surface, and a low-privilege authorization bypass can affect catalogue, order and content integrity before anyone notices. Our Implementation & Assessment Services can test your Adobe Commerce deployment and review its hardening; Supply Chain Defense & Third-Party Risk can track the Adobe Commerce versions running in your estate and the patch windows that determine exposure.