Two Adobe events cross this week:
- On September 22, Adobe shipped a batch of fixes covering ten critical CVEs across Campaign Classic, Experience Manager Forms JEE and Connect.
- On September 24, CISA added CVE-2026-71362 to the KEV catalog — an authorization flaw in Adobe Commerce / Magento, the second Magento KEV entry in three weeks, after CVE-2026-75650 on September 8.
We start with the one being exploited.
CVE-2026-71362 — Magento: authorization bypassed, in KEV
| Field | Value |
|---|---|
| CVSS 3.1 | 9.1 (CRITICAL) |
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| NVD published | 2026-08-11 |
| CISA KEV added | 2026-09-24 |
| CISA deadline | 2026-09-27 |
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.
Published in August, exploited in September. No authentication required (PR:N), high confidentiality and integrity impact: access to sensitive store resources — orders, customers, configuration.
Same version scope as the September 8 flaw:
| Product | Affected versions per NVD |
|---|---|
| Adobe Commerce | 2.4.4 → 2.4.8 |
| Adobe Commerce B2B | 1.3.3, 1.3.4, 1.4.2, 1.5.2, 1.5.3 |
| Magento Open Source | 2.4.6 → 2.4.9 |
If you applied the early-September fix, check that the August one was applied too: they're two separate patches. A store left on a July patch level is exposed to both.
Campaign Classic — seven CVEs, two of them 10.0 RCEs
Adobe Campaign Classic is the marketing automation platform that holds, by construction, the organisation's customer base: addresses, purchase history, segmentation, consents. The seven CVEs target versions 7.4.3 and 7.4.4 (NVD bounds).
| CVE | Nature | CVSS | Privileges required |
|---|---|---|---|
| CVE-2026-75699 | Code injection → execution | 10.0 | None |
| CVE-2026-75721 | Code injection → execution | 10.0 | None |
| CVE-2026-83660 | SSRF → privilege escalation | 9.9 | None |
| CVE-2026-89276 | Code injection → execution | 9.9 | Low |
| CVE-2026-82013 | SSRF → internal resource access | 9.9 | Low |
| CVE-2026-82443 | SSRF → internal resource access | 9.6 | Low |
| CVE-2026-82009 | SQL injection | 9.1 | High |
Two unauthenticated code executions with S:C: the impact extends beyond the platform. Three SSRFs reaching internal resources from the Campaign server — which is typically wired to customer databases, the CRM and sending systems.
For an organisation, the concrete stake is a large-scale personal data breach, with GDPR notification within 72 hours.
Experience Manager Forms JEE — CVE-2026-75745 (10.0)
Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution. [...] Exploitation of this issue does not require user interaction. Scope is changed.
Vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: code execution without authentication. AEM Forms JEE processes forms that are often administrative or regulatory — applications, contracts, case files — hence sensitive documents. NVD exposes no versions for this product: the Adobe advisory is authoritative.
Connect — two stored XSS (9.3)
CVE-2026-75684 and CVE-2026-75689: scripts injected into form fields, executed in the victim's browser, with possible session takeover. UI:R: the victim must view the booby-trapped page. Less urgent than the rest of the batch, but Adobe Connect already saw exploited flaws this summer.
Priorities
- Magento / Commerce: CVE-2026-71362 is in KEV, deadline September 27. Apply the Adobe security patch for your version — and check that the August and September fixes are both present.
- Campaign Classic: two unauthenticated 10.0 RCEs on the customer base. Update past 7.4.4 per the Adobe advisory.
- AEM Forms JEE: unauthenticated 10.0 RCE.
- Connect: normal cycle, unless broadly exposed to the public.
# Magento
php bin/magento --version
composer show magento/product-community-edition
Detection
- Magento: admin access with no matching session,
core_config_datachanges, recent admin accounts — see the detailed methodology in the September 8 article - Campaign Classic: outbound requests from the server to unexpected internal destinations (SSRF), bulk list exports, recently created workflows
- AEM Forms: unexpected child processes of the application server, files dropped in deployment directories
Why Continuous Monitoring of Your Adobe Estate Matters
Adobe ships fixes in batches, product by product, and organisations often run several of these products owned by different teams — e-commerce, marketing, online services. Eleven critical CVEs in one week, one of them in KEV: without a cross-product inventory, each team only sees its share.
With cveo.tech, inventory your Adobe products with exact versions, and get alerted whenever a critical CVE — particularly a KEV-listed one — affects them.