External risk intelligence

Adobe Commerce Arbitrary Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-92909

Adobe Commerce is an enterprise e-commerce platform designed to function as a public-facing web application. By its nature as an online storefront, it is intended to be reachable via the public internet to serve customers, making it a classic example of an internet-facing web service.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An Incorrect Authorization vulnerability has been identified in Adobe Commerce, which could allow an attacker to execute arbitrary code without any user interaction. This type of vulnerability, if exploited, could potentially impact the integrity and availability of the e-commerce platform. The primary concern is to confirm whether our Adobe Commerce instances are relevant and potentially exposed.

Authorization flaw allows code execution remotely.
Critical systems potentially at risk without action.
Confirm relevance and exposure to Adobe Commerce.

Attack Path

How an attacker could exploit the issue

An attacker could reach an Adobe Commerce instance over the network without needing any specific access privileges or user interaction. By leveraging an authorization flaw, they could then trigger the vulnerability, leading to the execution of arbitrary code on the system.

No privileges or user interaction needed.
Exploits an authorization flaw.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Adobe Commerce could allow an unauthenticated attacker to execute arbitrary code on the affected system. When supported by the advisory, this could lead to the compromise of the underlying system, impacting its availability and integrity.

Arbitrary code execution.
Network access without authentication.
System compromise and data integrity loss.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Adobe Commerce requires immediate attention from teams responsible for the e-commerce platform. Application owners and infrastructure teams should collaborate to locate all instances of Adobe Commerce, assess their exposure and business criticality, and identify the specific owner accountable for each deployment. Planning remediation efforts, including vendor coordination if necessary, should be prioritized based on this risk assessment.

Application owners and infrastructure teams.
Verify all Adobe Commerce deployments.
Plan vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Adobe Commerce?

Adobe Commerce is an enterprise-level e-commerce platform that powers online stores. It acts as a comprehensive web application for managing product catalogs, customer transactions, and storefront operations, typically hosting both front-end shopping experiences and complex back-end administrative functionality.

What does Incorrect Authorization mean for CVE-2026-92909?

This vulnerability, classified as CWE-863, occurs when a system fails to properly verify if a user has permission to perform a specific action. In this case, the flaw allows an attacker to bypass authorization checks entirely, enabling them to execute unauthorized code on the server as if they were a legitimate, authenticated user.

How is this vulnerability triggered?

An attacker triggers this flaw by sending specifically crafted network requests to the Adobe Commerce platform. Because the underlying issue is an authorization failure rather than a logic error requiring specific data, the vulnerability does not require the attacker to have an existing account, nor does it require any action from a legitimate user.

Do I need to worry about this if my site is not public?

According to Halo Surface Signal, Adobe Commerce is designed as a public-facing web application. While the vulnerability is network-reachable, any instance accessible via the internet faces the highest risk. If your instance is purely internal, it remains a target for any user or device already on your private network.

What should I do first to address CVE-2026-92909?

Your first step is to create a complete inventory of all Adobe Commerce deployments within your environment. Once identified, assign clear ownership for each instance and coordinate with those teams to assess business criticality. Finally, prepare to work with the vendor to apply necessary updates or guidance provided through their official security channels.

References

www.adobe.com/trust/security/products/commerce/apsb26-153.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.