CVE-2026-77774

CVE-2026-77774 is an incorrect authorization flaw (CWE-863) in Adobe Commerce, Adobe Commerce B2B, and Magento that lets an attacker bypass security features and gain unauthorized read access to protected information. The flaw is reachable over the network without credentials or user interaction (CVSS 3.1 8.6: AV:N/AC:L/PR:N/UI:N), and the changed scope indicates the vulnerable component crosses a trust boundary to affect resources outside its own security scope. A successful attacker gains unauthorized access to potentially confidential store data, while integrity and availability are not directly impacted (C:H/I:N/A:N). Any organization running Adobe Commerce, Adobe Commerce B2B, or Magento (including B2B deployments) on vulnerable versions is potentially affected. Exploitation has not been observed: there is no public proof-of-concept, no CISA KEV listing, and EPSS estimates only a ~0.5% probability of exploitation within 30 days.

What to do: Upgrade Adobe Commerce, Adobe Commerce B2B, and Magento installations to the patched release specified in Adobe's security bulletin for CVE-2026-77774, prioritizing internet-facing storefronts. Check that restricted resources (admin areas, APIs, and customer data) enforce authorization correctly and return data only to properly authenticated, authorized users. Monitor Adobe's advisory for exact affected version ranges and any interim mitigations until the fix is deployed.