CVE-2026-71362

CVE-2026-71362 carries a CVSS 9.1 rating for an Incorrect Authorization flaw in Adobe Commerce administrative functionality—no user interaction required. The EPSS score of 0.00478 suggests low probability of exploitation within 30 days. This gap is not a contradiction; it's a signal worth decoding. The EPSS metric models general internet-facing exploitation against exposed services. Adobe Commerce sits behind authentication, typically in enterprise environments with established patch cadences. The actors most capable of exploiting this flaw—those who already have authenticated access or integration partner credentials—aren't running the automated tooling that feeds EPSS telemetry. The low EPSS likely reflects who EPSS measures, not how difficult exploitation actually is. This matters because the authorization flaw class is a known genetic sequence in Adobe Commerce. CVE-2024-45116, CVE-2022-24087, and CVE-2021-21010 share the same Incorrect Authorization classification in administrative functionality. The pattern persists across version transitions because Adobe Commerce's extensibility model places authorization decisions on individual developers rather than enforcing deny-by-default at the framework level. Expect more of these. The blast radius extends beyond the application itself. Adobe Commerce connects to payment processors, ERPs, CRMs, and shipping APIs. A privilege escalation here isn't admin-panel access—it's a pivot point into an ecosystem handling customer PII, payment tokens, and order data. The CVSS 9.1 captures the endpoint's severity ceiling, but the realistic exploitation chain likely begins from a connected integration (an OAuth token, a service account, a webhook) that CVSS doesn't model as the entry point. For defenders, three actions matter now. First, patch—this flaw has no user interaction requirement, making automated exploitation viable. Second, implement compensating controls at the API gateway: enforce explicit allowlists for admin-adjacent routes, validate session context, and restrict source IP ranges where possible. Third, build detection for unauthorized administrative endpoint access regardless of whether specific endpoints are officially enumerated as affected—the genetic fault sequence means similar vulnerabilities will surface in new code paths. Map your integration mesh: payment processors, shipping APIs, and connected systems have their own patch cadences. A privilege escalation discovered today might pivot into an integration that won't accept certificate rotation for 90 days. That's where the 9.1 rating's true operational weight lives—not in the CVSS vector, but in the temporal debt it accrues against an interconnected ecosystem that patches asynchronously.

Reviewed through automated stages and approved by a human before publication.