MajorCritical vulnerability

CVE-2026-92908 (CVSS 8.3)

NVD · officialPublished Oct 13, 2026Risk 37/100

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction.

Technical details

CVSS

8.3

AV:NetworkAC:LowPR:LowUI:NoneC:HighI:HighA:Low

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source