CVE-2026-71362 CISA KEV · Actively exploitedSuited to automated attack · CISA
Adobe Commerce | Incorrect Authorization (CWE-863)
CVSS score
9.1
EPSS probability
%87.5
Risk score
15.9
Published
2 mo ago
Related Security News
Articles and analysis bulletins in which the press and security publications have covered this vulnerability:
Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws
Adobe has shipped updates to address multiple critical security vulnerabilities impacting ColdFusion, Commerce, and Campaign Classic that, if successfully exploited, could result in arbitrary code execution and privilege escalation. The most severe of the flaws are listed below - CVE-2026-48362 (CVSS score: 10.0) - An operating system command injection vulnerability in ColdFusion that could
Similar Vulnerabilities
8.8
CVE-2018-4878 Actively exploitedflash-plugin: use-after-free causing remote code execution (APSB18-03)
VendorRed HatProduct6Client-Supplementary-6.9.z:flash-plugin-0:28.0.0.161-1.el6_9.i686+4 etkilenen
RH
Patch verified Public Exploits:12EPSS %90
7.5
CVE-2010-2861 Actively exploitedPath traversal in N/a
Workaround Public Exploits:3EPSS %100
7.8
CVE-2016-4117 Actively exploitedVulnerability in N/a
Patch verified Public Exploits:2EPSS %94
7.8
CVE-2018-15982 Actively exploitedUse after free in N/a
Patch verified Public Exploits:1EPSS %90
7.8
CVE-2010-0188 Actively exploitedVulnerability in N/a
Patch verified Public Exploits:4EPSS %88
6.8
CVE-2014-0497 Actively exploitedflash-plugin: integer underflow flaw leads to arbitrary code execution (APSB14-04)VendorRed HatProduct5Client-Supplementary-5.10.Z:flash-plugin-0:11.2.202.336-1.el5.i386+6 etkilenen
RH
Patch verified Public Exploits:1EPSS %100
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-71362"