CVE-2026-77774: 
Adobe Commerce vulnerability analysis and mitigation

CVE-2026-77774 is an Incorrect Authorization vulnerability (CWE-863) in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source that allows unauthenticated remote attackers to bypass security controls and gain unauthorized read access to sensitive data. Disclosed on September 8, 2026, the vulnerability affects Adobe Commerce versions 2.4.4 through 2.4.9 (August 2026 patch levels), Adobe Commerce B2B versions 1.3.3 through 1.5.3 (August 2026 patch levels), and Magento Open Source versions up to 2.4.9 (August 2026 patch levels). It carries a CVSS v3.1 base score of 8.6 (High), with changed scope reflecting potential cross-boundary impact (Adobe Advisory).

The vulnerability is classified as CWE-863 (Incorrect Authorization), meaning the application fails to correctly verify whether a requester has the appropriate permissions before granting access to protected resources. The attack vector is network-based, requires no privileges, no user interaction, and has low attack complexity, making it trivially exploitable by any unauthenticated attacker. The changed scope indicator suggests that a successful exploit can affect resources beyond the vulnerable component itself — for example, accessing data belonging to other store views, customer accounts, or administrative data. No specific technical write-ups or public proof-of-concept code have been identified at this time (Adobe Advisory).

Successful exploitation results in a high confidentiality impact with no integrity or availability impact, meaning attackers can read sensitive data they are not authorized to access without modifying or disrupting the system. The changed scope indicates that the unauthorized read access may extend beyond the immediate application context, potentially exposing customer PII, order data, payment information, or B2B-specific business data across multiple store scopes. Given the unauthenticated nature of the attack, large numbers of Adobe Commerce and Magento deployments could be targeted at scale (Adobe Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at the time of disclosure. The vulnerability is marked as automatable ("yes") by NVD SSVC analysis, indicating it can be exploited at scale without manual interaction. The EPSS score is approximately 0.496%, reflecting a currently low but non-negligible probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog as of the disclosure date (Adobe Advisory).

Adobe has released security patches addressing this vulnerability as part of the September 2026 security update (APSB26-138). Affected users should upgrade to the September 2026 patch releases: Adobe Commerce 2.4.4-p19 / 2.4.5-p18 / 2.4.6-p16 / 2.4.7-p11 / 2.4.8-p6 / 2.4.9-p1 (or equivalent September 2026 patch levels), Adobe Commerce B2B 1.3.3 / 1.3.4 / 1.4.2 / 1.5.2 / 1.5.3 September 2026 patch releases, and Magento Open Source September 2026 patch releases. Administrators should also review access logs for any unauthorized data access attempts and monitor authorization-related events. No configuration-based workaround has been published; patching is the only recommended remediation (Adobe Advisory).

The CIS (Center for Internet Security) issued an advisory noting that multiple vulnerabilities in Adobe products, including this one, could allow for arbitrary code execution and security feature bypass, recommending immediate patching (CIS Advisory). AusCERT published bulletin ESB-2026.10690 alerting its constituency to the Adobe September 2026 patch release. Beyond Machines and other threat intelligence aggregators flagged the September 2026 Adobe patch batch as significant given the breadth of affected versions. No notable individual researcher commentary or social media discussion has been identified beyond standard vulnerability tracking coverage.