Full Report
Attempts to exploit a critical vulnerability (CVE-2026-71362) in Adobe's Commerce and Magento e-commerce platforms have been detected, potentially allowing attackers to hijack customer accounts. [...]
Analysis Summary
# Vulnerability: Adobe Commerce and Magento Account Takeover
## CVE Details
- **CVE ID:** CVE-2026-71362
- **CVSS Score:** 9.8 (Critical)
- **CWE:** Incorrect Authorization (CWE-863)
## Affected Systems
- **Products:** Adobe Commerce, Adobe Commerce B2B, and Magento Open Source.
- **Versions:** Currently supported release lines (specific versions requiring the August 2026 update).
- **Configurations:** Systems not yet updated with the August 2026 isolated patch files.
## Vulnerability Description
CVE-2026-71362 is an incorrect authorization vulnerability stemming from the improper handling of customer identity within account sessions. The flaw allows an unauthenticated attacker to manipulate session data to "switch" their session to that of another customer. This bypasses authentication mechanisms, granting the attacker elevated access to sensitive resources and private customer data.
## Exploitation
- **Status:** Exploited in the wild (Detected by Sansec Shield WAF); No public PoC currently cited in the article.
- **Complexity:** Low (Requires no existing account, administrator privileges, or user interaction).
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Access to private customer data and account details).
- **Integrity:** High (Ability to hijack and modify customer account settings).
- **Availability:** Low/Medium (Potential for account lockout or unauthorized changes).
## Remediation
### Patches
Adobe has released isolated patch files as part of the APSB26-92 security update. Note that these are distributed as individual patch files rather than updated Composer packages.
- **Requirement:** Administrators must ensure they are running the latest **-p** release for their specific supported branch before applying the isolated patch.
### Workarounds
- No specific software workarounds were provided; however, Sansec suggests that a Web Application Firewall (WAF) can be used to block known exploitation attempts.
## Detection
- **Indicators of Compromise:** Monitor for unusual session behavior or unauthorized changes to customer account data.
- **Detection methods and tools:** Use of Web Application Firewalls (e.g., Sansec Shield) to identify and block patterns associated with unauthorized session switching.
## References
- **Vendor Advisory:** helpx[.]adobe[.]com/security/products/magento/apsb26-92.html
- **Sansec Research:** sansec[.]io/research/adobe-commerce-account-takeover-apsb26-92
- **News Source:** bleepingcomputer[.]com/news/security/hackers-exploit-critical-adobe-commerce-flaw-to-hijack-customer-accounts/