Sansec Reports Attempts to Exploit Critical Adobe Commerce Flaw
Summary
Sansec says its Shield WAF is blocking attempts to exploit CVE-2026-71362, which could enable unauthenticated customer-account access in Adobe Commerce and Magento. Adobe says it is unaware of active in-the-wild exploitation and urges admins to patch.
Key points
- CVE-2026-71362 is an incorrect-authorization flaw that could let attackers switch customer sessions and access private account data without authentication.
- Sansec says it detected exploitation attempts and that its Shield WAF is blocking them; Adobe says it is unaware of active exploitation in the wild.
- The article says exploitation requires no existing account, administrator privileges, or user interaction.
- Adobe also patched six other vulnerabilities, including stored cross-site scripting, authorization, and privilege-escalation flaws.
- Website administrators are advised to apply the update for their supported Adobe Commerce, Commerce B2B, and Magento release lines.
Article Details
- Vulnerability Types
- Incorrect authorization
- Stored cross-site scripting
- Severity
- Critical
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
CVE-2026-48411CVE-2026-48411 (6.5, medium severity): Incorrect-authorization vulnerability that could enable a security-feature bypass.CVE-2026-48412CVE-2026-48412 (2.7, low severity): Incorrect-authorization vulnerability that could result in privilege escalation.CVE-2026-48413CVE-2026-48413 (8.7, high severity): Stored cross-site scripting vulnerability that could result in arbitrary code execution.CVE-2026-48414CVE-2026-48414 (7.7, high severity): Stored cross-site scripting vulnerability that could result in arbitrary code execution.CVE-2026-48415CVE-2026-48415 (7.6, high severity): Incorrect-authorization vulnerability affecting Adobe Commerce B2B that could enable a security-feature bypass.CVE-2026-48416CVE-2026-48416 (7.5, high severity): Incorrect-authorization vulnerability that could enable a security-feature bypass.CVE-2026-71362Attempts to exploit CVE-2026-71362 in Adobe Commerce and Magento are being blocked by Sansec’s Shield WAF, even though Adobe says it is not aware of active exploitation in the wild.
Vendors
AdobeAttempts to exploit CVE-2026-71362 in Adobe Commerce and Magento are being blocked by Sansec’s Shield WAF, even though Adobe says it is not aware of active exploitation in the wild.SansecAttempts to exploit CVE-2026-71362 in Adobe Commerce and Magento are being blocked by Sansec’s Shield WAF, even though Adobe says it is not aware of active exploitation in the wild.
Products
Adobe CommerceAttempts to exploit CVE-2026-71362 in Adobe Commerce and Magento are being blocked by Sansec’s Shield WAF, even though Adobe says it is not aware of active exploitation in the wild.Adobe Commerce B2BCVE-2026-48415 (7.6, high severity): Incorrect-authorization vulnerability affecting Adobe Commerce B2B that could enable a security-feature bypass.MagentoAttempts to exploit CVE-2026-71362 in Adobe Commerce and Magento are being blocked by Sansec’s Shield WAF, even though Adobe says it is not aware of active exploitation in the wild.