A Magento shop not updated per Adobe's bulletin is, as of today, on a list someone is already using.
The hole has been public since mid-August. What changed on 24 September is that CISA now has confirmation of real attacks.
Fact
The facts: on 24 September 2026 CISA added CVE-2026-71362 - incorrect authorisation in Adobe Commerce and Magento - to its Known Exploited Vulnerabilities (KEV) catalogue, with a deadline of 27 September for US federal agencies. According to the NVD description, the vulnerability can lead to privilege escalation and access to sensitive resources without any user action; Adobe rates it 9.1 (critical) on CVSS 3.1. The NVD record was published on 11 August 2026 and points to APSB26-92 as the vendor bulletin; NVD lists versions of Adobe Commerce, Adobe Commerce B2B and Magento Open Source as affected. The Adobe bulletin page returned an access denied error when we checked, so the fixed versions have not been verified first-hand.
What to do
Open the admin panel and check the version. Then open bulletin APSB26-92 from your own browser and compare. If your version is among the affected ones, you update right away.
Incorrect authorisation here means someone seeing or changing sensitive resources in the shop that they should not. No password, no click on your side.
A patch you still have not installed is an invitation with a date on it.
If you maintain other people's Magento shops, today you do not wait for the client to ask. You update and write to tell them it is done.
Sources
CVE-2026-71362 (NVD, with the CISA KEV section)CISA: Known Exploited Vulnerabilities CatalogAdobe Security Bulletin APSB26-92 (did not open when checked)The visual is generated code-art, no third-party images.