CVE-2026-92910
7.2HighPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-863
Impact
Unauthenticated remote attackers can bypass security controls to gain unauthorized read and limited write access to the application. No user interaction or local privileges are required.
Root cause
Incorrect authorization checks allow security feature bypasses across the application boundaries.
Affected systems
Adobe Commerce (exact versions not listed — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Fix & remediation
Upgrade to the patched version detailed in Adobe advisory APSB26-153 once identified; no interim workaround is documented.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction. Scope is changed.