Attackers have begun exploiting a critical vulnerability in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source that could allow unauthenticated account takeovers and access to sensitive customer data. The flaw, identified as CVE-2026-71362, carries a CVSS score of 9.1 and was publicly disclosed by Adobe in its APSB26-92 security bulletin.
The vulnerability enables an attacker to switch a customer's active session to a different customer account without requiring any prior authentication, administrative privileges, or user interaction. This grants the attacker full access to the victim's account and associated private information.
Cybersecurity firm Sansec reported blocking initial exploitation attempts shortly after Adobe's advisory was published. Sansec's analysis of Adobe's patch confirmed that the core issue lies in how Magento handles customer identity within account sessions.
Adobe released an isolated fix for CVE-2026-71362, which was included in the July 2026 patches for affected Commerce and Magento Open Source versions. Users are strongly urged to apply the update immediately.
The APSB26-92 bulletin addresses a total of seven vulnerabilities, with CVE-2026-71362 being the most severe. Other issues resolved in the update include stored cross-site scripting (XSS) and various authorization flaws.
