Critical Adobe Commerce Flaw Actively Exploited Post-Disclosure
A cybersecurity alert has been issued regarding a critical-severity vulnerability, CVE-2026-71362, in Adobe Commerce. This flaw, rated with a CVSS score of 9.1, is an incorrect authorization issue that allows unauthenticated attackers to elevate their privileges. Alarmingly, exploitation attempts were observed almost immediately after its public disclosure, according to webstore security firm Sansec. While Adobe initially stated it had no evidence of in-the-wild exploitation when it released its August 2026 Patch Tuesday updates, Sansec quickly reported blocking the first attempts to leverage this CVE, underscoring the urgency for immediate patching.
Technical Details: Understanding the Session Switching Vulnerability
The core of CVE-2026-71362 lies in how Adobe Commerce and Magento handle customer identity within account sessions. Sansec’s analysis confirmed that the vulnerability enables attackers to switch a customer session to another customer’s account. This allows remote, unauthenticated attackers to gain full access to a victim’s account and their private customer data. Such access could lead to unauthorized purchases, data theft, and significant reputational damage for affected merchants. The flaw impacts all versions of Adobe Commerce, Adobe Commerce B2B, and Magento Open Source up to and including those running the July 2026 patches. This broad impact necessitates swift action across the entire Adobe Commerce ecosystem.
Prioritising Mitigation: How to Address Adobe Commerce CVE-2026-71362
Given the confirmed active exploitation, immediate remediation is paramount. Adobe has released an isolated patch specifically for this critical flaw, alongside fixes for six other security defects. This isolated patch allows merchants to apply the fix with reduced risk of integration issues and delays. For security professionals searching for how to fix Adobe Commerce CVE-2026-71362, the official Adobe advisory and its installation instructions are the definitive guide. Applying this patch promptly will prevent successful exploitation, which could otherwise lead to arbitrary code execution, security feature bypass, and privilege escalation, as noted by Adobe.
Mitigating Risk for Adobe Commerce B2B Privilege Escalation and Magento Open Source Account Takeover
Organizations running affected versions, including those utilizing Adobe Commerce B2B features, must understand the severe implications of Adobe Commerce B2B privilege escalation. The ability for unauthenticated attackers to take over customer accounts represents a direct threat to sensitive business data and customer trust. Similarly, for Magento Open Source account takeover mitigation, applying this patch is the single most critical step. Merchants should prioritize applying the latest security updates as soon as possible, following Adobe’s guidance. Regular security audits and monitoring for unusual session activity can also help detect and respond to potential exploitation attempts, but proactive patching remains the most effective defense against this critical vulnerability.
Related: CVE-2026-43503: Linux Kernel DirtyClone Flaw Grants Root Access, Confused Deputy Flaws in Google Cloud & Azure: Admin Bypass