CVE-2026-77109: Incorrect Authorization (CWE-863) in Adobe Adobe Commerce

Adobe Commerce contains an Incorrect Authorization vulnerability (CWE-863) that could be exploited by an attacker to escalate privileges and access restricted resources. The vulnerability does not require any user interaction and affects the security scope, potentially allowing unauthorized access to sensitive functions or data. The CVSS 3.1 base score is 8.6, indicating high severity, with attack vector network, low attack complexity, no privileges required, no user interaction, and scope changed. No patch or remediation details are provided in the available data.

Successful exploitation of this vulnerability could allow an attacker to gain elevated privileges within Adobe Commerce, accessing restricted resources that should normally be protected. This could lead to unauthorized actions impacting the integrity of the system. Confidentiality and availability impacts are not indicated. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor Adobe's security advisories for updates and apply any official fixes once available.