CVE-2026-77774: Adobe Commerce Auth Bypass Vulnerability

CVE-2026-77774 Overview

Adobe Commerce contains an Incorrect Authorization vulnerability [CWE-863] that allows an unauthenticated network attacker to bypass security controls and gain unauthorized read access to protected resources. The flaw affects Adobe Commerce, Adobe Commerce B2B, and Magento Open Source across multiple 2.4.x release branches. Exploitation requires no user interaction, and the scope is changed, meaning the impact extends beyond the vulnerable component's security authority. Adobe published mitigation guidance in advisory APSB26-138.

Critical Impact
Remote, unauthenticated attackers can bypass authorization checks in Adobe Commerce storefronts to read sensitive data that should require valid credentials or privileges.

Affected Products

Adobe Commerce 2.4.4 through 2.4.9 (multiple patch levels)
Adobe Commerce B2B 1.3.3 through 1.5.3 (multiple patch levels)
Magento Open Source 2.4.7 through 2.4.9

Discovery Timeline

2026-09-08 - CVE-2026-77774 published to the National Vulnerability Database
2026-09-09 - CVE-2026-77774 record last modified in NVD

Technical Details for CVE-2026-77774

Vulnerability Analysis

The vulnerability stems from an authorization control that fails to correctly enforce access restrictions on a protected resource within Adobe Commerce. Because the affected endpoint is reachable over the network without prior authentication, an attacker can interact with it directly from the internet. The changed scope indicates that a successful bypass in the vulnerable component grants read access to data owned by another security context, such as another store, customer account, or administrative subsystem. Only confidentiality is affected; the vulnerability does not, on its own, permit modification of data or disruption of service. However, disclosed data such as customer records, order details, or configuration values can enable follow-on attacks including account takeover and targeted fraud.

Root Cause

CWE-863 (Incorrect Authorization) indicates the application performs an authorization check but reaches an incorrect decision. In practice, this class of flaw commonly arises from missing role validation, trust in client-supplied identifiers, incorrect scope binding between session and requested object, or logic errors in permission comparisons within controllers, REST/GraphQL resolvers, or service layers.

Attack Vector

An unauthenticated attacker sends crafted HTTP requests to the exposed Adobe Commerce endpoint over the network. The request references a resource that the requester should not be permitted to read. The flawed authorization logic returns the resource content, disclosing information that belongs to another store view, customer, or backend component. Because no user interaction is required, exploitation can be automated at scale against internet-facing Commerce and Magento storefronts.

No public proof-of-concept code is available at the time of writing. Refer to the Adobe Security Advisory APSB26-138 for vendor-supplied technical details.

Detection Methods for CVE-2026-77774

Indicators of Compromise

Unauthenticated HTTP requests to REST or GraphQL endpoints returning 200 OK responses containing customer, order, or configuration data.
Repeated enumeration patterns against /rest/, /graphql, or admin-adjacent URIs from a single source IP or distributed botnet.
Anomalous spikes in outbound response sizes from Commerce web nodes without corresponding authenticated sessions.

Detection Strategies

Correlate web server access logs with application authentication logs to surface requests that returned protected content without an authenticated session identifier.
Deploy Web Application Firewall (WAF) rules that flag access to sensitive Commerce endpoints from clients lacking valid session cookies or bearer tokens.
Baseline normal GraphQL and REST query volume per client, and alert on deviations that indicate scripted enumeration.

Monitoring Recommendations

Forward Adobe Commerce application, PHP-FPM, and reverse-proxy logs to a centralized analytics platform for retention and query.
Monitor for the presence of Adobe advisory APSB26-138 patch levels in your asset inventory to identify unpatched Commerce instances.
Track EPSS movement for CVE-2026-77774 as an early signal of exploit weaponization.

How to Mitigate CVE-2026-77774

Immediate Actions Required

Inventory all Adobe Commerce, Commerce B2B, and Magento Open Source deployments and identify versions that fall within the affected ranges.
Apply the security update referenced in Adobe advisory APSB26-138 on all affected storefronts, staging environments, and internal instances.
Restrict access to non-public Commerce administrative and API endpoints using IP allow-listing or VPN gating until patches are deployed.

Patch Information

Adobe published fixes and installation guidance in Adobe Security Advisory APSB26-138. Upgrade Adobe Commerce, Adobe Commerce B2B, and Magento Open Source to the patched release listed for your current 2.4.x branch. Validate patch application by confirming the installed composer package versions match the fixed releases specified by Adobe.

Workarounds

Place the Commerce storefront behind a WAF and enable rules that block unauthenticated access attempts to protected REST and GraphQL operations.
Rotate API integration tokens and administrative credentials after patching, in case data disclosed pre-patch included secrets.
Review and tighten role-based access control (RBAC) definitions to reduce the blast radius of any residual authorization defects.

bash

# Example: verify installed Adobe Commerce version and check against APSB26-138
cd /var/www/html
php bin/magento --version
composer show magento/product-community-edition | grep versions
composer show magento/product-enterprise-edition | grep versions
# Compare output with fixed versions listed at:
# https://helpx.adobe.com/security/products/magento/apsb26-138.html