CVE-2026-71362
Known exploited · CISA KEV
CVSS 9.1 CRITICAL: adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation.
CISA federal remediation date Sep 27
Vulnerabilities · 91 days ago
Sansec reported blocking the first attempts to exploit a critical Adobe Commerce flaw shortly after Adobe disclosed it in August 2026. CVE-2026-71362 affects Commerce, Commerce B2B, and Magento Open Source versions through the July 2026 patches.
The authorization flaw lets a remote attacker without an account make a customer session appear to belong to another customer, exposing that person’s account and private data. Adobe said it had no evidence of in-the-wild exploitation; Sansec’s report describes attempts, not confirmed account compromises.
Adobe says its isolated patch is designed to reduce delays caused by integration issues. For stores still testing deployment, the gap after disclosure is an exposure window; retailers on other storefront platforms face the same timing risk when a fix prompts immediate testing by attackers.
Known exploited · CISA KEV
CVSS 9.1 CRITICAL: adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation.
CISA federal remediation date Sep 27
5 sources covering this story
Adobe Commerce Bug Targeted Immediately After Disclosure
The first exploitation attempts targeting CVE-2026-71362 were observed shortly after Adobe released patches.
Hackers exploit critical Adobe Commerce flaw to hijack customer accounts
Attempts to exploit a critical vulnerability (CVE-2026-71362) in Adobe's Commerce and Magento e-commerce platforms have been detected, potentially allowing attackers to hijack customer accounts.
Kwetsbaarheden verholpen in Adobe ColdFusion
Adobe heeft meerdere kwetsbaarheden verholpen in Adobe ColdFusion versies 2025.0.11, 2023.0.22 en eerdere versies.
Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws
Adobe patches seven ColdFusion, Commerce, and Campaign Classic flaws that could enable code execution, privilege escalation, or denial-of-service.
Adobe: aggiornamenti di sicurezza
Adobe ha rilasciato aggiornamenti di sicurezza per risolvere molteplici vulnerabilità, di cui 7 con gravità “critica” e 27 con gravità “alta”, nei prodotti Commerce, Magento, ColdFusion, Campaign Classic, Lightroom Classic, Content Credentials Rust SDK, C2PA Tool, Content Credentials JS SDK.
Kwetsbaarheden verholpen in Adobe Commerce
Adobe heeft meerdere kwetsbaarheden verholpen in Adobe Commerce.
Kwetsbaarheden verholpen in Adobe Campaign Classic
Adobe heeft kwetsbaarheden verholpen in Adobe Campaign Classic.
Adobe Urges Immediate Patching of Critical ColdFusion, Campaign Classic Flaws
The security defects could be exploited for arbitrary code execution and denial-of-service.
Kwetsbaarheden verholpen in Adobe Campaign Classic
Adobe heeft meerdere kwetsbaarheden verholpen in Adobe Campaign Classic.
Adobe: aggiornamenti di sicurezza
Adobe ha rilasciato aggiornamenti di sicurezza per correggere 7 vulnerabilità, di cui 6 con gravità "critica" e una con gravità "alta", presenti in Adobe Campaign Classic, piattaforma che consente di pianificare, gestire e automatizzare campagne di marketing multicanale (email, SMS, direct mail e altro), centralizzando i dati dei clienti per creare comunicazioni personalizzate e monitorarne i risultati.
Part of the PlainSec briefing for 2026-08-16