# CVE-2026-71362: Adobe Commerce Account Takeover — Patch Now

> Hackers are immediately exploiting CVE-2026-71362, a critical authorization flaw in Adobe Commerce, to take over customer accounts. Patch urgently.

- Published: 2026-08-14T01:07:52.000Z
- Severity: critical
- Category: Vulnerabilities
- Tags: Privilege Escalation, Account Takeover, CVE-2026-71362, Adobe Commerce, Magento Open Source
- CVEs: CVE-2026-71362 (CVSS 9.1)
- Author: Runtime Rebel Intel
- Primary source: https://www.securityweek.com/adobe-commerce-bug-targeted-immediately-after-disclosure/
- Canonical: https://runtimerebel.com/blog/cve-2026-71362-adobe-commerce-account-takeover-patch-now

## Key points

- Unauthenticated attackers are actively exploiting CVE-2026-71362 in Adobe Commerce to compromise customer accounts.
- All Adobe Commerce, Commerce B2B, and Magento Open Source versions released up to July 2026 are vulnerable.
- Apply the critical isolated security patch for CVE-2026-71362 immediately to prevent account takeovers.

## Critical Adobe Commerce Flaw Actively Exploited Post-Disclosure

A cybersecurity alert has been issued regarding a critical-severity [vulnerability](/glossary#vulnerability), [CVE-2026-71362](https://nvd.nist.gov/vuln/detail/CVE-2026-71362), in Adobe Commerce. This flaw, rated with a [CVSS](/glossary#cvss) score of 9.1, is an incorrect [authorization](/glossary#authorization) issue that allows unauthenticated attackers to elevate their privileges. Alarmingly, exploitation attempts were observed almost immediately after its public disclosure, according to webstore security firm Sansec. While Adobe initially stated it had no evidence of in-the-wild exploitation when it released its August 2026 [Patch](/glossary#patch) Tuesday updates, Sansec quickly reported blocking the first attempts to leverage this [CVE](/glossary#cve), underscoring the urgency for immediate patching.

### Technical Details: Understanding the Session Switching Vulnerability

The core of [CVE-2026-71362](https://nvd.nist.gov/vuln/detail/CVE-2026-71362) lies in how Adobe Commerce and Magento handle customer identity within account sessions. Sansec's analysis confirmed that the vulnerability enables attackers to switch a customer session to another customer's account. This allows remote, unauthenticated attackers to gain full access to a victim's account and their private customer data. Such access could lead to unauthorized purchases, data theft, and significant reputational damage for affected merchants. The flaw impacts all versions of Adobe Commerce, Adobe Commerce B2B, and Magento Open Source up to and including those running the July 2026 patches. This broad impact necessitates swift action across the entire Adobe Commerce ecosystem.

### Prioritising Mitigation: How to Address Adobe Commerce CVE-2026-71362

Given the confirmed active exploitation, immediate remediation is paramount. Adobe has released an isolated patch specifically for this critical flaw, alongside fixes for six other security defects. This isolated patch allows merchants to apply the fix with reduced risk of integration issues and delays. For security professionals searching for **how to fix Adobe Commerce CVE-2026-71362**, the official Adobe advisory and its installation instructions are the definitive guide. Applying this patch promptly will prevent successful exploitation, which could otherwise lead to arbitrary code execution, security feature bypass, and [privilege escalation](/glossary#privilege-escalation), as noted by Adobe.

### Mitigating Risk for Adobe Commerce B2B Privilege Escalation and Magento Open Source Account Takeover

Organizations running affected versions, including those utilizing Adobe Commerce B2B features, must understand the severe implications of **Adobe Commerce B2B privilege escalation**. The ability for unauthenticated attackers to take over customer accounts represents a direct threat to sensitive business data and customer trust. Similarly, for **Magento Open Source account takeover mitigation**, applying this patch is the single most critical step. Merchants should prioritize applying the latest security updates as soon as possible, following Adobe's guidance. Regular security audits and monitoring for unusual session activity can also help detect and respond to potential exploitation attempts, but proactive patching remains the most effective defense against this critical vulnerability.

**Related:** [CVE-2026-43503: Linux Kernel DirtyClone Flaw Grants Root Access](/blog/cve-2026-43503-linux-kernel-dirtyclone-flaw-grants-root-access), [Confused Deputy Flaws in Google Cloud & Azure: Admin Bypass](/blog/confused-deputy-flaws-in-google-cloud-azure-admin-bypass)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/cve-2026-71362-adobe-commerce-account-takeover-patch-now