Attackers are already probing a critical Adobe Commerce flaw that lets them hop into shoppers' accounts
CVE-2026-71362 needs no login, no admin rights and no victim clicks. Sansec says its firewall is already blocking live exploitation attempts despite Adobe seeing none.
Key points
- Adobe patched CVE-2026-71362, a critical flaw in Adobe Commerce and Magento, in its August 2026 security update.
- The bug lets an attacker hijack another shopper's session with no password, no admin rights and no action required from the victim.
- Sansec says its web application firewall is already blocking exploitation attempts, even as Adobe states it has seen none in the wild.
- Six other flaws were fixed in the same update, four rated high severity, one medium, one low.
- Store owners on Adobe Commerce, Commerce B2B or Magento should apply the isolated patch file for their release line immediately.
Attackers are already trying to break into Adobe Commerce and Magento stores through a newly disclosed flaw that hands them full access to shoppers' accounts.
The bug is tracked as CVE-2026-71362. Adobe rates it critical. It's what security people call an "incorrect authorization" flaw, meaning the software fails to properly check who you are before letting you in. No existing account is needed. No admin rights. The victim doesn't have to click anything.
What does the flaw actually let attackers do?
It lets them steal shopper accounts. Dutch e-commerce security firm Sansec, which reviewed Adobe's patch, found that the bug lets an attacker switch their own browser session to a different customer's account. Once inside, they can access order history, saved payment details and anything else the real customer could see. Magento was mishandling how it tracked which customer a session belonged to. Fix that check, and the door closes.
Is anyone actually being attacked yet?
Probably yes. Adobe's advisory says it isn't aware of exploits in the wild. Sansec disagrees: the company told BleepingComputer that its Shield web application firewall, a filter that sits in front of a shop and blocks malicious requests, is already stopping attempts to trigger CVE-2026-71362. That gap matters. Vendors often learn about live exploitation only after a customer reports a breach, sometimes weeks after the fact. We reported on a similar Magento storefront attack involving unsafe deserialization on 4 June, when CISA added CVE-2026-45247 to its Known Exploited Vulnerabilities catalogue.
What else was patched?
Adobe fixed six other bugs in the same August 2026 update. Four are rated high severity, one medium, one low.
| CVE | Severity | What it does | Needs login? |
|---|---|---|---|
| CVE-2026-71362 | Critical | Session takeover of any customer account | No |
| CVE-2026-48413 | High (8.7) | Stored XSS leading to code execution | Yes, non-admin |
| CVE-2026-48414 | High (7.7) | Stored XSS leading to code execution | Yes, admin |
| CVE-2026-48415 | High (7.6) | Security bypass in Commerce B2B | Yes, non-admin |
| CVE-2026-48416 | High (7.5) | Security bypass | No |
| CVE-2026-48411 | Medium (6.5) | Security bypass | Yes, admin |
| CVE-2026-48412 | Low (2.7) | Privilege escalation | Yes, admin |
Stored XSS, or cross-site scripting, means an attacker plants malicious code in the site itself so it runs in someone else's browser later.
How do store owners fix it?
Install the patch. Adobe distributes these monthly fixes as isolated patch files, not full releases, so administrators must be on the latest -p release for their supported branch first, then apply the patch on top. Sansec has flagged this as a common stumbling block.
Should shoppers worry?
If your account is on a store built on Adobe Commerce or Magento, now's a reasonable moment to change that password. Don't reuse the one protecting your email or bank account. Check your card statement over the next few weeks for small unexpected charges, which are often the first sign someone has your details. If the retailer sends a breach notice under GDPR or applicable US state law, follow whatever specific steps they list.
