CVE-2026-71362
Known exploited · CISA KEV
CVSS 9.1 CRITICAL: adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation.
CISA federal remediation date Sep 27
Vulnerabilities & Exploits · Web App Attack
Sansec reported blocking the first attempts to exploit a critical Adobe Commerce flaw shortly after Adobe disclosed it in August 2026. CVE-2026-71362 affects Commerce, Commerce B2B, and Magento Open Source versions through the July 2026 patches.
The authorization flaw lets a remote attacker without an account make a customer session appear to belong to another customer, exposing that person’s account and private data. Adobe said it had no evidence of in-the-wild exploitation; Sansec’s report describes attempts, not confirmed account compromises.
Adobe says its isolated patch is designed to reduce delays caused by integration issues. For stores still testing deployment, the gap after disclosure is an exposure window; retailers on other storefront platforms face the same timing risk when a fix prompts immediate testing by attackers.
5 sources · Aug 13
Known exploited · CISA KEV
CVSS 9.1 CRITICAL: adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation.
CISA federal remediation date Sep 27
SecurityWeek
Adobe Commerce Bug Targeted Immediately After Disclosure
The first exploitation attempts targeting CVE-2026-71362 were observed shortly after Adobe released patches.
originalBleepingComputer
Hackers exploit critical Adobe Commerce flaw to hijack customer accounts
Attempts to exploit a critical vulnerability (CVE-2026-71362) in Adobe's Commerce and Magento e-commerce platforms have been detected, potentially allowing attackers to hijack customer accounts.
originalNCSC-NL Advisories
Kwetsbaarheden verholpen in Adobe ColdFusion
Adobe heeft meerdere kwetsbaarheden verholpen in Adobe ColdFusion versies 2025.0.11, 2023.0.22 en eerdere versies.
originalPart of the PlainSec briefing for 2026-08-15
Every edition of this story: Adobe Commerce account flaw drew attacks after disclosure