Online Storefronts on the KEV List: Magento CVE-2026-71362 and What to Ask Your MSP
CISA added Adobe Commerce / Magento CVE-2026-71362 to KEV on September 24, 2026. Critical incorrect-authorization flaw — what SMB e-commerce owners should ask their MSP today.
If your business takes orders online through Adobe Commerce or Magento Open Source, yesterday’s CISA alert is not “federal IT news.” It is a storefront risk ticket.
On September 24, 2026, CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, including CVE-2026-71362 — an Incorrect Authorization flaw in Adobe Commerce and Magento. CISA also listed CVE-2026-5430 (WSO2 path traversal). Binding Operational Directive BOD 26-04 requires federal agencies to prioritize KEV remediation on high-impact exposed assets; CISA encourages all organizations to do the same.
What Adobe Confirmed in APSB26-92
- Vulnerability: Incorrect Authorization (CWE-863) enabling privilege escalation.
- Severity: Critical — CVSS base score 9.1.
- Authentication: Not required to exploit; admin privileges not required.
- Affected: Adobe Commerce, Adobe Commerce B2B, and Magento Open Source — July 2026 builds and earlier on listed trains (for Magento Open Source: 2.4.9-2026-jul through 2.4.6-2026-jul and earlier).
- Fix: Update to the matching -2026-aug security releases (for example Magento Open Source 2.4.9-2026-aug). Adobe bulletin APSB26-92 was published August 11, 2026; KEV status arrived September 24 when CISA confirmed active exploitation evidence.
Why This Hits Everyday SMB Commerce
- Magento is still common among mid-market and specialty retailers, manufacturers with direct-to-consumer shops, and agencies hosting client stores.
- Unauthenticated privilege escalation is the nightmare class: attackers do not need a stolen password first.
- “We patched in August” needs proof. Many stores freeze versions during peak seasons; KEV is the signal to verify, not assume.
- Payment and customer data sit behind the same admin plane that privilege escalation targets.
The Ticket I Want Owners to Send Today
“Please confirm whether we run Adobe Commerce, Adobe Commerce B2B, or Magento Open Source (including agency-hosted stores). If yes: list each environment’s exact version, confirm upgrade to the APSB26-92 August 2026 fixed builds for CVE-2026-71362, confirm admin and API surfaces are not exposed beyond need, and note any unusual admin creation, privilege changes, or order anomalies since CISA’s September 24, 2026 KEV addition. If we do not use Magento/Adobe Commerce, name the e-commerce platform we do use and its current patch level for actively exploited flaws.”
How This Fits Everyday Risk Triage
KEV entries are a prioritization signal, not a complete vulnerability program. Pair this ticket with a living list of internet-facing apps (storefront, staging, admin URL). While you are there, ask whether WSO2 components (the other Sep 24 KEV) appear in any identity or integration middleware you run.
Need a calm second opinion on storefront exposure or patch evidence for insurance? CyberIntelPro / Security Medic works MSP-safe with Hudson Valley SMBs and their partners.
References
- CISA, “CISA Adds Two Known Exploited Vulnerabilities to Catalog” (Sep 24, 2026) — CVE-2026-71362, CVE-2026-5430: cisa.gov/…/2026/09/24/…
- Adobe, Security update for Adobe Commerce | APSB26-92 (Aug 11, 2026): helpx.adobe.com/…/apsb26-92.html
- CISA Known Exploited Vulnerabilities Catalog: cisa.gov/known-exploited-vulnerabilities-catalog