Our automated tracking framework flagged that CISA added CVE-2026-71362 (Adobe Commerce and Magento) to the Known Exploited Vulnerabilities (KEV) catalog on September 29, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. ”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-71362 by September 27, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-71362 |
| Vendor / product | Adobe Commerce and Magento |
| Vulnerability | Adobe Commerce and Magento Incorrect Authorization Vulnerability |
| CVSS base score | 9.1 |
| Added to KEV | September 24, 2026 |
| Days public before listing (NVD → KEV lag) | 44 |
| Federal patch deadline | September 27, 2026 |
| Known ransomware use | No |
How This Compares to Adobe’s Track Record
This one was public for just 44 days before CISA confirmed exploitation — faster than Adobe’s 2571-day median, meaning attackers moved unusually quickly. Adobe currently ranks #3 on our KEV Lag leaderboard.
| Adobe in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 82 |
| Median lag (public → KEV listing) | 2571 days |
| 0-day rate (exploited at or before disclosure) | 4% |
| Entries tied to known ransomware campaigns | 10 |
For perspective, the median across all 1728 tracked KEV entries is 245 days — Adobe’s exploited vulnerabilities are flagged slower than the catalog average.
Other Recent Adobe KEV Additions
The most recent Adobe vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-75650 | Commerce and Magento | September 8, 2026 | 1 | No |
| CVE-2026-48282 | ColdFusion | July 7, 2026 | 7 | No |
| CVE-2009-3459 | Acrobat and Reader | May 20, 2026 | 6063 | No |
| CVE-2026-34621 | Acrobat and Reader | April 13, 2026 | 2 | No |
| CVE-2020-9715 | Acrobat | April 13, 2026 | 2063 | No |
What This Means for Defenders
CISA has added CVE-2026-71362 to its Known Exploited Vulnerabilities (KEV) catalog. This Adobe Commerce and Magento vulnerability has a CVSS base score of 9.1 and was added to KEV on September 24, 2026, with a federal patch deadline of September 27, 2026. Patching is an urgent priority for all organizations using these platforms, especially those running public-facing e-commerce operations. If you can’t patch before the deadline, restrict network access to affected platforms and enhance monitoring for anomalous activity.
This vulnerability was public for 44 days before its KEV listing. This short NVD-to-KEV lag suggests exploitation began quickly after public disclosure, leaving a narrow window for detection and response for unpatched systems. There’s no known ransomware use associated with CVE-2026-71362.
Related Coverage
- Adobe’s CVE-2026-75650 Was Exploited in 1 Days — Well Under Its 2627-Day Median (September 2026)
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
