Incorrect authorization in Adobe products - CVE-2026-77774

Vulnerability identifier: #VU148855

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-77774

CWE-ID: CWE-863

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass security features.

The vulnerability exists due to incorrect authorization in authorization controls when handling requests. A remote attacker can exploit the authorization flaw to bypass security features.

Adobe Commerce B2B
Magento Open Source
Adobe Commerce (formerly Magento Commerce)

Install security update from vendor's website.

Adobe Commerce B2B - addressed in versions 1.3.3-2026-sep, 1.3.4-2026-sep, 1.4.2-2026-sep, 1.5.2-2026-sep, 1.5.3-2026-sep
Magento Open Source - addressed in versions 2.4.7-2026-sep, 2.4.8-2026-sep, 2.4.9-2026-sep
Adobe Commerce (formerly Magento Commerce) - addressed in versions 2.4.4-2026-sep, 2.4.5-2026-sep, 2.4.6-2026-sep, 2.4.7-2026-sep, 2.4.8-2026-sep, 2.4.9-2026-sep

• https://helpx.adobe.com/security/products/magento/apsb26-138.html

• Remote code execution in Adobe Commerce and Magento Open Source