Magento Vulnerability Scanner — CVE-2026-71362
Enter your site's domain to run a free, read-only check for this vulnerability. We send a few ordinary HTTP GET requests to your homepage and a handful of well-known paths — no attack traffic, no exploitation attempts.
Affected versions
| Magento Open Source / Adobe Commerce 2.4.x | 2.4.0 – 2.4.7-p3 (below 2.4.7-p4) |
|---|---|
| Also tracked | CVE-2026-75650 shares this page (same fingerprint probe) |
Checked at: 2026-10-22 (data)
How this check works
- We send a small number of ordinary HTTP GET requests — the same kind a browser sends when visiting your site.
- We never send exploit payloads or attack traffic. The check only reads publicly visible version headers and pages.
- Check results are cached for 10 minutes and are not stored in a database. Your query is not associated with your identity.
FAQ
What is CVE-2026-71362?
CVE-2026-71362 is a critical Adobe Commerce / Magento Open Source vulnerability, tracked together with CVE-2026-75650 on this page (both share the same version fingerprint). Unpatched 2.4.x stores are affected; the fix shipped in Adobe's October 2026 security bulletin.
How do I check my Magento version?
Enter your store's domain above. We probe the public version signals Magento exposes: the /magento_version endpoint, composer.json if exposed, and version strings in the storefront footer. No signup, no admin access needed.
Is my Adobe Commerce (Commerce on cloud) affected too?
Yes — the affected ranges cover both Magento Open Source and Adobe Commerce 2.4.x below the fixed patch. Cloud merchants receive the patch through the Adobe Commerce cloud patching process; on-premise merchants apply it manually.
Why did I get an “Inconclusive” result?
Stores commonly hide their version (custom themes remove the footer version, /magento_version is disabled) or sit behind a WAF/CDN that blocks the probe. Verify the exact version on the server with bin/magento --version, or in Admin → System → Web Setup Wizard.
Does “Not detected” mean my store is safe?
No. It means no visible version signal matched the affected range from outside. eCommerce stores are high-value targets — verify the deployed version on the server and apply Adobe's security patches on a fixed schedule.