Update Adobe Commerce and Magento Open Source Now to Fix Critical Zero-Click RCE Vulnerability

Attackers can execute arbitrary code on servers running vulnerable versions of Adobe Commerce and Magento Open Source. The flaw, identified as CVE-2026-92909, stems from incorrect authorization logic that fails to properly restrict access. According to the National Vulnerability Database, this weakness allows malicious actors to run commands in the context of the current user without needing any interaction from legitimate users.

The National Vulnerability Database rates CVE-2026-92909 as Critical with a CVSS score of 9.8. The issue is classified under CWE-863, indicating a failure to perform authorization checks correctly. This vulnerability impacts a wide range of releases, including Adobe Commerce up to version 2.4.9-2026-sep and Magento Open Source up to version 2.4.9-2026-sep. Older releases such as 2.4.8, 2.4.7, 2.4.6, and 2.4.5 through the 2026-sep update are also affected.

What we know

Adobe Commerce B2B is also vulnerable to this authorization bypass. Versions up to 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, and 1.3.3-2026-sep contain the flaw. The description notes that an attacker could exploit this issue to execute arbitrary code. Because no user interaction is required for exploitation, the attack surface is broad, exposing any internet-facing instance of these software versions to potential compromise.

Defender's checklist

• Inventory all instances of Adobe Commerce and Magento Open Source across your environment.
• Verify current version numbers against the affected list ending in 2026-sep.
• Check server logs for signs of unauthorized code execution or unexpected command runs.
• Monitor for new security advisories from Adobe regarding this specific CVE.

What analysts watch for

Teams usually examine web server access logs for unusual request patterns that precede code execution. Analysts check for unexpected file modifications or new scripts appearing in web directories. Persistence mechanisms often involve modified configuration files or injected web shells. Investigators look for outbound connections to unknown IP addresses that may indicate command-and-control communication. Reviewing process trees helps identify child processes spawned by the web server that do not match normal application behavior.

Background: Authorization bypass vulnerabilities

Authentication confirms who you are, while authorization determines what you can do. Most bypass flaws occur because systems assume valid login equals valid access. You must verify permissions for every request independently of identity checks to prevent unauthorized data exposure.

Read the full guide: Authorization Bypass Myths: Why Common Security Beliefs Fail

What to do and how to stay safe: Adobe Commerce

• Audit your deployment to confirm if you are running any of the affected versions listed in the NVD record.
• Restrict network access to administrative interfaces using IP whitelisting until updates are applied.
• Monitor system processes for unexpected execution commands that deviate from standard application behavior.
• Prepare to apply patches immediately once the vendor provides a confirmed update for CVE-2026-92909.

Step-by-step guide: Security Advisories: Small Business Patching Strategy

General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific versions of Adobe Commerce are affected by CVE-2026-92909?

Adobe Commerce versions up to 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, and 2.4.5-2026-sep are affected.

Does exploiting this vulnerability require a user to click a link?

No, the NVD record states that exploitation of this issue does not require user interaction.

What is the CVSS score for CVE-2026-92909?

The National Vulnerability Database assigns a CVSS score of 9.8 to this vulnerability.