CVE-2026-92909: Incorrect Authorization (CWE-863) in Adobe Adobe Commerce

CVE-2026-92909 describes an Incorrect Authorization vulnerability in Adobe Commerce that enables an attacker to execute arbitrary code with the privileges of the current user. The vulnerability does not require any user interaction to be exploited, making it a significant risk. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided, and no known exploits are reported in the wild.

Successful exploitation could lead to arbitrary code execution in the context of the current user, potentially compromising system confidentiality, integrity, and availability. Given the lack of required privileges or user interaction, the vulnerability poses a critical risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor Adobe's security advisories for updates and apply patches promptly once released.