Urgent: Update Adobe Commerce & Magento to 2.4.9-2026-sep to Fix Critical CVE-2026-92909 RCE Flaw

Administrators managing Adobe Commerce or Magento Open Source platforms must immediately verify their current software versions against the affected list. The National Vulnerability Database records CVE-2026-92909 as a critical authorization failure. This weakness allows attackers to execute arbitrary code on the server. The risk is severe because exploitation requires no user interaction, meaning attackers can target exposed systems directly.

In plain English

The core problem is that the software fails to properly check if a user has permission to perform certain actions. An attacker can send specific requests to the server that bypass these checks. Once the request is accepted, the attacker can run commands as the current user. This effectively gives them control over parts of the application. The lack of required interaction makes this threat particularly difficult to mitigate without patching.

The background

The flaw is categorized under CWE-863, which refers to incorrect authorization. It impacts a wide range of recent releases. Affected Adobe Commerce versions include 2.4.9-2026-sep through 2.4.4-2026-sep. Adobe Commerce B2B versions up to 1.5.3-2026-sep are also vulnerable. Magento Open Source versions up to 2.4.9-2026-sep face the same risk. The National Vulnerability Database assigns a CVSS score of 9.8 to this issue, reflecting its high potential for damage and ease of exploitation.

What changes now

Security teams must prioritize scanning their environments for these specific version strings. Any instance running an affected version is considered immediately at risk. The zero-click nature of the exploit means that public-facing instances are prime targets for automated scanning bots. Organizations should assume exposure if their systems are reachable from the internet. Delaying action increases the window of opportunity for attackers to deploy malicious payloads or gain unauthorized access to sensitive data.

Who needs to act first

Teams should prioritize systems with direct internet exposure, such as public storefronts or API endpoints. Before applying any changes, ensure you have verified backups of both code and databases. Test the update in a staging environment that mirrors production to catch compatibility issues. Monitor logs for unusual activity during the transition. If immediate patching is not possible, restrict access using network-level controls like IP allow-lists or web application firewalls to reduce the attack surface while a fix is developed.

What to do and how to stay safe: Adobe Commerce

• Audit all servers to identify installations of Adobe Commerce or Magento Open Source matching the affected version ranges listed above.
• Implement network segmentation or firewall rules to limit access to vulnerable systems from untrusted networks while preparing for updates.
• Monitor server logs and web application firewall alerts for unusual request patterns or unauthorized access attempts indicative of exploitation.
• Prepare a rollback plan and verify backups before deploying any changes to ensure business continuity in case of failure.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems

General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-92909?

It is a critical authorization vulnerability in Adobe Commerce and Magento Open Source that allows arbitrary code execution without user interaction.

Which versions of Adobe Commerce are affected?

Versions up to 2.4.9-2026-sep, including 2.4.8, 2.4.7, 2.4.6, 2.4.5, and 2.4.4-2026-sep, as well as B2B versions up to 1.5.3-2026-sep.

Is user interaction required to exploit this flaw?

No, the National Vulnerability Database states that exploitation of this issue does not require user interaction.