Adobe Commerce Vulnerability Targeted Shortly After Disclosure
Summary
Sansec reported blocking initial attempts to exploit CVE-2026-71362, an authorization flaw that can expose other customers’ accounts and private data. Adobe issued a patch for affected Commerce and Magento versions.
Key points
- CVE-2026-71362 is an incorrect-authorization flaw rated CVSS 9.1 that can allow unauthenticated attackers to access another customer’s account and private data.
- Sansec reported blocking the first exploitation attempts shortly after Adobe disclosed the flaw; the article does not report successful exploitation.
- Adobe said it had no evidence of in-the-wild exploitation when it addressed the vulnerability.
- The flaw affects Adobe Commerce, Commerce B2B, and Magento Open Source versions through the July 2026 patches.
- Adobe released an isolated patch for the flaw alongside fixes for six other security defects and published installation instructions.
- Sansec said its review of the patch confirmed that the flaw could let attackers switch a customer session to another account. Adobe changed how the products handle customer identity in account sessions.
Article Details
- Vulnerability Types
- Incorrect authorization
- Severity
- Critical (CVSS 9.1)
- Affected Versions
- Adobe Commerce: versions up to and including those running the July 2026 patches
- Commerce B2B: versions up to and including those running the July 2026 patches
- Magento Open Source: versions up to and including those running the July 2026 patches
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationThe flaw was reported to let unauthenticated attackers elevate privileges by switching a customer session to another customer account.T1190 · Exploit Public-Facing ApplicationSansec reported blocking exploitation attempts against the remotely exploitable Adobe Commerce vulnerability shortly after disclosure.
CVE
Vendors
Products
Adobe CommerceHackers started targeting a fresh critical-severity Adobe Commerce vulnerability immediately after public disclosure, webstore security firm Sansec reports.Commerce B2BThe vulnerability impacts all Commerce, Commerce B2B, and Magento Open Source versions up to and including those running the July 2026 patches.MagentoThe vulnerability impacts all Commerce, Commerce B2B, and Magento Open Source versions up to and including those running the July 2026 patches.