CVE-2026-92908: Adobe Commerce | Incorrect Authorization (CWE-863)
Published Oct 13, 2026
·Updated
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction.
Affected Software
1 affected component
Adobe Adobe Commerce
Event History
Oct 13, 2026
CVE Published
via MITRE·06:15 PM
Data Sourced
via MITRE·06:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require an unauthenticated attacker?
No. The vulnerability requires low privileges, so the attacker must already have a low-privileged level of access.
2
Is user interaction needed for exploitation?
No. Exploitation does not require user interaction.