Adobe Commerce Privilege Escalation (CVE-2026-71362) Actively Exploited Post-Disclosure¶

A critical incorrect authorization vulnerability, CVE-2026-71362 (CVSS score of 9.1), affecting Adobe Commerce and Magento Open Source, is being actively exploited immediately following its public disclosure. This flaw allows unauthenticated attackers to elevate their privileges and take over customer accounts, posing a significant risk to e-commerce platforms and sensitive customer data. Webstore security firm Sansec reported blocking the first exploitation attempts shortly after Adobe released patches during August 2026 Patch Tuesday.

Vulnerability Details: CVE-2026-71362¶

CVE-2026-71362 is an incorrect authorization issue. This class of vulnerability arises when a system fails to properly verify that a user or process has the necessary permissions to perform an action. In the context of Adobe Commerce and Magento, this means an attacker can bypass intended authorization checks to gain unauthorized access to other user accounts.

Root Cause: The vulnerability lies in how Commerce and Magento handle customer identity in account sessions. Specifically, there's a flaw in the modification of how these platforms manage and validate customer sessions, allowing for session hijacking or manipulation.

Exploitation Flow: 1. An unauthenticated attacker interacts with a vulnerable Adobe Commerce or Magento Open Source instance. 2. The attacker exploits the incorrect authorization flaw to manipulate or switch a customer's session. 3. This session manipulation grants the attacker access to another customer's account. 4. With access to the victim's account, the attacker can view and potentially modify private customer data, place orders, or perform other actions as the legitimate user.

Active Exploitation and Impact¶

Adobe resolved CVE-2026-71362 on August 2026 Patch Tuesday, noting that while there was no evidence of in-the-wild exploitation prior to disclosure, threat actors have historically targeted Commerce vulnerabilities quickly. Sansec's immediate post-disclosure detection confirms that this pattern holds true, with attackers rapidly attempting to exploit the newly revealed flaw.

The impact of successful exploitation is profound for e-commerce businesses:

• Customer Account Takeover: Attackers can hijack legitimate customer accounts, potentially leading to financial fraud, theft of personal information, and damage to customer trust.
• Data Breach: Access to customer accounts can expose sensitive data such as names, addresses, order history, and potentially partial payment information.
• Reputational Damage: Successful attacks erode customer confidence and can lead to significant brand damage and legal ramifications.
• Financial Loss: Direct financial losses from fraudulent purchases or compromised payment details.

Affected Systems and Remediation¶

The vulnerability impacts all Adobe Commerce, Commerce B2B, and Magento Open Source versions up to and including those running the July 2026 patches.

Immediate Remediation:

1. Apply Security Updates Immediately: Adobe has released an isolated patch to fix CVE-2026-71362 and six other security defects. Organizations running affected versions must apply these security updates as soon as possible. Adobe's advisory and installation instructions are crucial for timely remediation.
   • Adobe Advisory: https://helpx.adobe.com/security/products/magento/apsb26-92.html
   • Installation Instructions: https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-40380
2. Regular Patch Management: Establish a robust and rapid patch management process for all e-commerce platforms and their underlying infrastructure.
3. Monitor for Anomalous Account Activity: Implement monitoring for unusual login patterns, unexpected changes to customer profiles, or suspicious order placements that could indicate account takeover.
4. Enforce Strong Authentication: Encourage or enforce multi-factor authentication (MFA) for customer accounts to add an extra layer of security, even if a session is compromised.
5. Web Application Firewall (WAF): Utilize a WAF to help detect and block known exploitation patterns and protect against common web vulnerabilities.

The rapid targeting of CVE-2026-71362 after disclosure serves as a stark reminder for e-commerce operators: the window between vulnerability disclosure and active exploitation is often extremely narrow. Proactive and agile security measures are essential to protect platforms and customer data.