CVE-2026-77774: High Authorization Bypass in Adobe Commerce

CVE-2026-77774 is a high severity (CVSS 8.6) incorrect authorization flaw in Adobe Commerce, Commerce B2B and Magento. An unauthenticated attacker could bypass a security feature and gain unauthorized read access. Adobe's bulletin is APSB26-138. We could not retrieve it, so confirm the fixed versions there.

What's affected

Per the record, the affected products are Adobe Commerce, Adobe Commerce B2B and Adobe Magento. The record says exploitation needs no user interaction and the scope is changed, which means the impact can reach beyond the vulnerable component.

We could not fetch Adobe's bulletin (the site returned an access denied response to our request), so we cannot state affected or fixed version numbers. Do not guess from this page. Open APSB26-138 and read the version table for your release line, including any isolated patch listed for it.

How to check if you're exposed

Start from your inventory of storefronts and admin hosts. Find the installed Commerce or Magento version.

bin/magento --version
composer show magento/product-community-edition

For Adobe Commerce editions, the package name differs, so use composer show with the package you installed. Then compare the result to the version table in APSB26-138. Also record whether your store runs the B2B module, since the record lists it as a separate affected product.

What to do now

1. Read Adobe's bulletin APSB26-138 and find the patch or release for your version line.
2. Schedule the update through your normal Commerce deployment process, staging first, then production.
3. If a patch cannot ship this week, review what a read-only authorization bypass could expose in your store, such as order, customer or configuration data, and consider access controls at your edge or web application firewall.
4. After patching, review access logs for the period before the update for unusual unauthenticated reads against protected endpoints.

Why it matters

The weakness is CWE-863, incorrect authorization. The application checks a request, but the check does not enforce the rule the designers intended, so a caller who should be refused is allowed to read. The record rates confidentiality impact high and integrity and availability none, so this is a data exposure issue, not a code execution one.

Commerce platforms hold customer and order data, which is why a read bypass with no login required rates 8.6. The scope change in the vector is the reason the number is high for a read-only bug. The record's KEV flag is false and Adobe's bulletin, which we could not read, is the place to see whether Adobe reports exploitation.

Quick check

Sources

• Adobe security bulletin APSB26-138 (could not be retrieved, check directly)

Last reviewed: 18 October 2026.