CVE-2026-77111: Incorrect Authorization (CWE-863) in Adobe Adobe Commerce

CVE-2026-77111 is an Incorrect Authorization vulnerability in Adobe Commerce. It enables an attacker who already has high privileges to bypass security features and obtain unauthorized write access. The vulnerability affects the security scope and can lead to limited availability disruption. Exploitation does not require any user interaction, increasing the risk of automated or remote attacks. The CVSS v3.1 score is 8.7, indicating high severity with network attack vector, low attack complexity, high privileges required, no user interaction, changed scope, no confidentiality impact, high integrity impact, and high availability impact.

An attacker with high privileges can bypass security mechanisms to gain unauthorized write access, potentially modifying data or configurations. This can lead to a limited disruption of service availability. There is no confidentiality impact reported. The scope change indicates that the vulnerability affects components beyond the originally intended security boundaries.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict high privilege access to trusted administrators only and monitor for unusual write activities.