Incorrect authorization in Adobe products - CVE-2026-77111

Vulnerability identifier: #VU148853

CSH Severity: Low

CVSS v4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-77111

CWE-ID: CWE-863

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to bypass security features.

The vulnerability exists due to incorrect authorization in authorization controls when handling requests. A remote privileged user can exploit the authorization flaw to bypass security features.

Adobe Commerce B2B
Magento Open Source
Adobe Commerce (formerly Magento Commerce)

Install security update from vendor's website.

Adobe Commerce B2B - addressed in versions 1.3.3-2026-sep, 1.3.4-2026-sep, 1.4.2-2026-sep, 1.5.2-2026-sep, 1.5.3-2026-sep
Magento Open Source - addressed in versions 2.4.7-2026-sep, 2.4.8-2026-sep, 2.4.9-2026-sep
Adobe Commerce (formerly Magento Commerce) - addressed in versions 2.4.4-2026-sep, 2.4.5-2026-sep, 2.4.6-2026-sep, 2.4.7-2026-sep, 2.4.8-2026-sep, 2.4.9-2026-sep

• https://helpx.adobe.com/security/products/magento/apsb26-138.html

• Remote code execution in Adobe Commerce and Magento Open Source