{"id":"CVE-2026-92909","published":"2026-10-13T19:21:43.613","lastModified":"2026-10-15T11:18:04.833","description":"Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://www.adobe.com/trust/security/products/commerce/apsb26-153.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Adobe Commerce suffers from an incorrect authorization flaw that allows attackers to execute arbitrary code as the current user without requiring any interaction. This vulnerability represents a critical risk because it can lead to full system compromise when exploited.","exploitability":"The vulnerability is highly exploitable with no user interaction required, making it easy for attackers to leverage once they gain initial access to the application.","blast_radius":"If exploited, this flaw could allow attackers to execute arbitrary code on affected Adobe Commerce systems, potentially leading to complete system compromise and data breaches across the entire commerce platform.","remediation":"No fixed version is published. Disable the affected feature or restrict access to the named endpoint until a patch is available.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","auth-bypass","web"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:51:01.897Z"}}