CVE-2026-77109

Adobe Commerce, Adobe Commerce B2B, and Magento are affected by an incorrect authorization flaw (CWE-863) in the platform's access-control handling. Because the vector requires no prior privileges and no user interaction, a remote, unauthenticated attacker can trigger the issue directly over the network. Successful exploitation allows the attacker to gain elevated access to resources that should be restricted, resulting in a high-impact integrity compromise (the scope-change flag indicates a second authority boundary, such as the application vs. its data or admin scope, is affected). Any organization running the affected versions of these e-commerce platforms is exposed, with storefronts handling customer and order data the primary concern. There is currently no known public proof-of-concept, no listing in CISA's KEV catalog, and only a modest 0.4% 30-day exploitation probability (EPSS), so exploitation in the wild is not yet confirmed.

What to do: Patch by upgrading to the fixed release listed in Adobe's security bulletin for this CVE, since the source data does not specify exact version numbers; prioritize internet-exposed admin and API surfaces. Until patched, restrict network access to administrative and API endpoints and review logs for unexpected privilege changes or access to restricted resources. Track Adobe's bulletin for corrected versions across all three affected products (Commerce, Commerce B2B, Magento).