Exploitation attempts have been detected for a critical vulnerability in Adobe Commerce and Magento e-commerce platforms, identified as CVE-2026-71362. This flaw, described as an incorrect authorization vulnerability, could allow attackers to gain elevated access to sensitive resources without authentication, potentially leading to customer account hijackings.
Adobe issued a security update on August 11, 2026, addressing seven vulnerabilities, including CVE-2026-71362. While Adobe stated in its advisory that it was not aware of any in-the-wild exploits for the fixed issues, the e-commerce security firm Sansec reported that its Shield web application firewall (WAF) is already blocking attempts to exploit CVE-2026-71362.
Sansec's analysis of Adobe's patch confirmed that the vulnerability stems from Magento's improper handling of customer identity within an account session. Exploiting this flaw requires no existing account, administrator privileges, or user interaction. Once exploited, attackers can switch a customer's session to another customer account, granting them access to the victim's account and private customer data.
In addition to CVE-2026-71362, Adobe's August 2026 security update addressed six other vulnerabilities. Four of these received a high-severity rating: CVE-2026-48414 (CVSS score 7.7), a stored cross-site scripting vulnerability requiring authentication and administrator privileges for arbitrary code execution; CVE-2026-48413 (CVSS score 8.7), another stored cross-site scripting vulnerability allowing arbitrary code execution with authentication but no administrator privileges; CVE-2026-48415 (CVSS score 7.6), an incorrect-authorization vulnerability affecting Adobe Commerce B2B that could bypass security features with authentication but no administrator privileges; and CVE-2026-48416 (CVSS score 7.5), an incorrect-authorization vulnerability that enables a security-feature bypass without requiring authentication or administrator privileges.
The remaining two vulnerabilities addressed were of medium and low severity: CVE-2026-48411 (CVSS score 6.5), a medium-severity incorrect-authorization vulnerability enabling a security-feature bypass, requiring authentication and administrator privileges; and CVE-2026-48412 (CVSS score 2.7), a low-severity incorrect-authorization vulnerability leading to privilege escalation, also requiring authentication and administrator privileges.
Website administrators are strongly advised to apply the August 2026 security update for all supported Commerce, Commerce B2B, and Magento release lines as soon as possible. Sansec noted that these monthly fixes are distributed as isolated patch files rather than new security releases or updated Composer packages. Administrators must ensure they are running the latest -p release available for their supported release branch before applying the corresponding isolated patch.
