Blog · 2-hour update · 2026-10-26

CVE-2026-71362 Adobe Commerce: exploited in the wild, how to patch

By the PatchTheCVE security team · Updated 2026-10-26 · Data from NVD, CISA KEV, EPSS and vendor advisories

Most urgent: CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability
Critical severity (CVSS 9.1), exploited in the wild, remotely exploitable, no login needed. Recommended action: upgrade to 2.4.4.

On 26 October 2026, 10 new CVEs were published that we track: 0 critical, 8 already exploited in the wild (CISA KEV) and 0 with a fix or vendor patch available. Each one is ranked by severity, exploitation signals and how easy it is to reach, so you can patch the right ones first.

Key takeaways

Most urgent: CVE-2026-71362 (Adobe Commerce): upgrade to 2.4.4.
8 exploited in the wild (CISA KEV): patch these before anything else.
5 of the top 8 can be attacked over the network without a login.
0 of 10 new CVEs already have a fix or vendor patch.

What happened in this 2-hour window: the most serious item is CVE-2026-71362 in commerce (critical, CVSS 9.1, priority 95/100). Recommended action: upgrade to 2.4.4. 8 new CVEs from the list below are already being exploited (CVE-2026-71362, CVE-2026-19490, CVE-2026-110447, and more), so those go first. 5 of the 8 top items can be attacked remotely without a login. 0 of 10 new CVEs already have a fix or vendor patch; for the other 10, follow the downgrade or mitigation steps until one ships.

Patch these first

CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability

Risk: Critical (CVSS 9.1), priority 95/100 (patch now)
Exploitation: exploited in the wild (CISA KEV); attackable over the network without a login
Affected: adobe commerce
What to do: upgrade to 2.4.4 for adobe commerce

Why it ranks here: critical severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev).

References: NVD · Vendor Advisory

CVE-2026-19490: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability

Risk: Critical (CVSS 9.8), priority 92/100 (patch now)
Exploitation: exploited in the wild (CISA KEV); attackable over the network without a login
Affected: citrix netscaler application delivery controller
What to do: upgrade to 13.1-37.277, 13.1-63.21, 14.1-73.32 for citrix netscaler application delivery controller

Why it ranks here: critical severity; epss top 2%: very likely to be exploited; exploited in the wild (cisa kev).

References: NVD · Vendor Advisory

CVE-2026-110447: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Risk: Critical (CVSS 9.2), priority 92/100 (patch now)
Exploitation: exploited in the wild (CISA KEV); attackable over the network without a login
Affected: Collabora Collabora Online – Built-in CODE Server
What to do: apply the vendor mitigation for Collabora Collabora Online – Built-in CODE Server

Why it ranks here: critical severity; epss top 4%: very likely to be exploited; exploited in the wild (cisa kev).

References: NVD

CVE-2026-64849: MLflow Server-Side Request Forgery Vulnerability

Risk: Critical (CVSS 9.3), priority 91/100 (patch now)
Exploitation: exploited in the wild (CISA KEV); attackable over the network without a login
Affected: lfprojects mlflow
What to do: upgrade to 3.15.0 for lfprojects mlflow

Why it ranks here: critical severity; epss top 4%: very likely to be exploited; exploited in the wild (cisa kev).

References: NVD · Patch · Exploit, Issue Tracking

CVE-2026-65660: Microsoft SharePoint Code Injection Vulnerability

Risk: High (CVSS 8.8), priority 85/100 (patch now)
Exploitation: exploited in the wild (CISA KEV)
Affected: microsoft sharepoint server
What to do: upgrade to 16.0.19725.20522 for microsoft sharepoint server

Why it ranks here: high severity; epss top 5%: very likely to be exploited; exploited in the wild (cisa kev).

References: NVD · Patch, Vendor Advisory

CVE-2026-114625: Arista VeloCloud Orchestrator SQL Injection Vulnerability

Risk: Critical (CVSS 9.9), priority 78/100 (patch now)
Exploitation: exploited in the wild (CISA KEV)
Affected: arista velocloud orchestrator
What to do: upgrade to 5.2.3.18, 6.1.3.10, 6.4.2.12 for arista velocloud orchestrator

Why it ranks here: critical severity; exploited in the wild (cisa kev); covered by 4 security sources.

References: NVD · Mitigation, Vendor Advisory

CVE-2026-20349: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability

Risk: High (CVSS 8.6), priority 76/100 (patch now)
Exploitation: exploited in the wild (CISA KEV); attackable over the network without a login
Affected: cisco adaptive security appliance software
What to do: apply the vendor mitigation for cisco adaptive security appliance software

Why it ranks here: high severity; exploited in the wild (cisa kev); remotely exploitable, no login, no user action.

References: NVD · Vendor Advisory

CVE-2026-68820: Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

Risk: High (CVSS 7.0), priority 61/100 (patch now)
Exploitation: exploited in the wild (CISA KEV)
Affected: microsoft windows 10 1607
What to do: upgrade to 10.0.14393.9418 for microsoft windows 10 1607

Why it ranks here: high severity; exploited in the wild (cisa kev); on your watchlist.

References: NVD · Patch, Vendor Advisory

How to act on this list

Start with anything marked exploited or patch now.
Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.

FAQ

What is the most serious vulnerability published on 26 October 2026?

CVE-2026-71362 (Adobe Commerce and Magento Incorrect Authorization Vulnerability ) ranks highest, with a priority score of 95/100. Recommended action: upgrade to 2.4.4.

Are any of the new CVEs exploited in the wild?

Yes, 8 of the new CVEs appear on the CISA Known Exploited Vulnerabilities list. Patch those first.

Should I downgrade if there is no fix yet?

Only when an older release is confirmed unaffected and the package is not a core system component. Downgrades can break dependent software, so test first and hold the package until a fix ships.

Sources

NIST National Vulnerability Database: CVE details and affected versions
CVE Program: official CVE records
CISA Known Exploited Vulnerabilities catalog: exploitation in the wild
FIRST EPSS: exploit probability
Distribution and vendor advisories linked under each item.

Keep reading

← All posts