CVE-2026-77774: 
Adobe Commerce vulnerability analysis and mitigation

CVE-2026-77774 is an Incorrect Authorization vulnerability (CWE-863) in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source that allows unauthenticated remote attackers to bypass security controls and gain unauthorized read access to sensitive data. The vulnerability was published on September 8, 2026, and affects Adobe Commerce versions 2.4.4 through 2.4.9 (August 2026 patch level and earlier), Adobe Commerce B2B versions 1.3.3 through 1.5.3 (August 2026 patch level and earlier), and Magento Open Source versions up to 2.4.9 (August 2026 patch level and earlier). It carries a CVSS v3.1 base score of 8.6 (High), with changed scope reflecting potential cross-boundary impact (Adobe Advisory).

The vulnerability is classified as CWE-863 (Incorrect Authorization), meaning the application fails to properly verify whether a requester has the necessary permissions before granting access to protected resources. An unauthenticated attacker can exploit this flaw over the network with low attack complexity and no user interaction required, making it fully automatable. The changed scope indicator suggests that a successful exploit can affect resources beyond the vulnerable component itself — for example, accessing data belonging to other tenants, stores, or system components within the Commerce environment. No public technical write-ups or proof-of-concept code have been identified at this time (Adobe Advisory).

Successful exploitation allows an unauthenticated attacker to bypass authorization controls and gain unauthorized read access to sensitive data within Adobe Commerce or Magento Open Source installations. The confidentiality impact is rated High, while integrity and availability are unaffected, meaning attackers can exfiltrate sensitive information — such as customer data, order details, or configuration settings — without modifying or disrupting the system. The changed scope means the data exposure risk may extend beyond the directly targeted component, potentially affecting multiple stores or B2B customer accounts within the same Commerce instance (Adobe Advisory).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Adobe Advisory). The vulnerability is rated automatable by NVD's SSVC assessment, meaning it can be exploited at scale without manual interaction. The EPSS score is approximately 0.496%, indicating a relatively low (but non-negligible) probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog as of the disclosure date.

Adobe has released security patches addressing this vulnerability as part of the September 2026 security update (APSB26-138). Administrators should upgrade to the September 2026 patch releases for their respective product lines: Adobe Commerce 2.4.4-2026-sep, 2.4.5-2026-sep, 2.4.6-2026-sep, 2.4.7-2026-sep, 2.4.8-2026-sep, or 2.4.9-2026-sep; Adobe Commerce B2B 1.3.3-2026-sep, 1.3.4-2026-sep, 1.4.2-2026-sep, 1.5.2-2026-sep, or 1.5.3-2026-sep; and Magento Open Source 2.4.7-2026-sep, 2.4.8-2026-sep, or 2.4.9-2026-sep. As an interim measure, review and restrict public-facing API endpoints and monitor access logs for anomalous unauthenticated requests to sensitive data resources (Adobe Advisory).

The CIS (Center for Internet Security) issued an advisory noting that multiple vulnerabilities in Adobe products, including this one, could allow for arbitrary code execution and unauthorized access, recommending prompt patching (CIS Advisory). AusCERT also published a bulletin (ESB-2026.10690) alerting its constituency to the September 2026 Adobe Commerce security updates. No significant independent researcher commentary or social media discussion has been identified beyond standard vulnerability aggregator coverage.