Adobe Commerce contains an Incorrect Authorization vulnerability (CWE-863) identified as CVE-2026-77108. This vulnerability permits an attacker to gain elevated privileges, potentially accessing sensitive information without any user interaction. The CVSS 3.1 vector indicates the attack can be performed remotely with low complexity and no privileges or user interaction required. As of the current data, no remediation level or patch information has been provided by the vendor.

Successful exploitation of this vulnerability could lead to privilege escalation, granting an attacker unauthorized elevated access to sensitive data within Adobe Commerce. The vulnerability does not impact integrity or availability but compromises confidentiality. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor Adobe's security advisories for updates. No vendor-provided mitigation or temporary fix information is currently available.