{"basis":"claimed","id":"CVE-2026-71362","name":"Adobe Commerce and Magento Incorrect Authorization Vulnerability ","vendorProject":"Adobe","product":"Commerce and Magento ","publishedAt":"2026-08-11","cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"exploited":{"kevAdded":"2026-09-24","dueDate":"2026-09-27","ransomware":false},"epss":{"score":0.90491,"percentile":0.99801,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"none","firstOn":null,"daysToRule":null},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"rule","firstOn":"2026-09-16","daysToRule":36},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":"Adobe Commerce | Incorrect Authorization (CWE-863)","description":"Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.","cwes":["CWE-863"],"vendors":[{"vendor":"cloudflare","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2026-09-16","firstIsNew":true,"daysToRule":36,"daysAtMost":null,"freePlan":false,"claims":[{"id":"a9f1a2982238545bd75a339551f2529aa083efee039cc76c2440e8477e5788d6","cve_id":"CVE-2026-71362","vendor":"f5","product":"Attack signatures","rule_id":"200020254","rule_name":"Adobe Commerce Session Hijacking","change":"new","default_action":null,"published_on":"2026-09-16","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200020254 \"Adobe Commerce Session Hijacking\" (Session Hijacking, risk High), systems: PHP. References: CVE-2026-71362.","first_seen_at":"2026-11-02T21:00:24.327Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T22:17:38.477Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"passed","templateId":"CVE-2026-71362","templatePath":"http/cves/2026/CVE-2026-71362.yaml","requests":6,"blockedRequests":0,"rules":[],"note":"","requestDetail":[{"method":"GET","path":"/customer/account/create","status":200,"blocked":false,"rules":[]},{"method":"POST","path":"/customer/account/createPost","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/customer/account/edit","status":200,"blocked":false,"rules":[]},{"method":"POST","path":"/customer/account/editPost","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/customer/account/edit","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/customer/section/load?…","status":200,"blocked":false,"rules":[]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"passed","templateId":"CVE-2026-71362","templatePath":"http/cves/2026/CVE-2026-71362.yaml","requests":6,"blockedRequests":0,"rules":[],"note":"","requestDetail":[{"method":"GET","path":"/customer/account/create","status":200,"blocked":false,"rules":[]},{"method":"POST","path":"/customer/account/createPost","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/customer/account/edit","status":200,"blocked":false,"rules":[]},{"method":"POST","path":"/customer/account/editPost","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/customer/account/edit","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/customer/section/load?…","status":200,"blocked":false,"rules":[]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-20","posts":0},{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0}],"top_posts":[],"exploit_repositories":[]}}