CVE-2026-71362: Adobe Commerce Account Takeover Exploited in the Wild, CVSS 9.1

Adobe's August patch Tuesday fixed CVE-2026-71362, a critical Adobe Commerce account-takeover flaw (CVSS 9.1). Attackers weaponized it within hours; Sansec Shield blocked the first exploit attempts against Commerce, Commerce B2B, and Magento Open Source 2.4.4–2.4.9.

In August 2026, Adobe released APSB26-92, patching seven security flaws in Adobe Commerce, Commerce B2B, and Magento Open Source. CVE-2026-71362 is a customer account-takeover vulnerability scored CVSS 9.1 (Critical). Attackers folded it into weaponized scans within hours of the patch. Ecommerce security firm Sansec intercepted the first exploit attempts in customer environments.

Incident overview

CVE-2026-71362 is an incorrect authorization flaw in the core Commerce/Magento customer-session handling path. A remote, unauthenticated attacker can switch a customer session onto any other customer account—no credentials, no admin privileges, no victim interaction. The defect affects Commerce, Commerce B2B, and Magento Open Source 2.4.4 through 2.4.9. Any instance still on the July patch or earlier is at takeover risk.

Technical details

Sansec reverse-engineered the patch and confirmed the root cause: Magento does not adequately verify that the target account is bound to the current session when handling identity switches. A crafted HTTP request causes session logic to attach the current connection to an arbitrary account, granting private profile data, order history, stored payment methods, and membership benefits. Adobe fixed this by changing how Commerce/Magento handles customer identity in account sessions.

Unlike classic Magecart-style checkout skimming, account takeover bypasses CSP, SRI, and other checkout-page defenses. Attackers view the victim account as a legitimate session and slowly drain stored payment tokens. Server-side logs look like normal customer activity; routine endpoint monitoring rarely flags it.

Impact

The risk has three facets:

• CVSS 9.1 Critical, vector AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:L — zero interaction, zero credentials;
• Patch and exploit landed almost together. Sansec observed scanning/exploitation from multiple IPs shortly after Adobe's advisory;
• Magento's long-tail ecosystem patches slowly. Many SMBs run free, customizable Magento storefronts and lag large retailers; one bug can become a mass account-takeover event.

If attackers mass-take over accounts and fire fraud on stored payment methods, merchants also face chargeback liability from payment processors.

Remediation

Immediate actions

• Log into the Commerce/Magento admin, confirm the version, and install the APSB26-92 hotfix per Adobe's advisory;
• Deploy WAF rules that block CVE-2026-71362 exploit signatures. Adobe and major vendors have published signatures as a pre-patch stopgap;
• Audit recent auth and session logs for bulk logins, cross-account access, and anomalous IPs/geolocations.

This week

• Inventory stored payment-method tokens and send reset notices to accounts with suspicious access in the pre-patch window;
• Assess Magento core and extension compatibility; treat core/extension upgrades as ongoing ops, not quarterly maintenance;
• Hosted-cloud customers must confirm patch status with their provider; do not assume it is applied.

Sources

• SecurityWeek: Adobe Commerce flaw exploited immediately after disclosure
• Sansec: APSB26-92 Magento account-takeover analysis
• Adobe Security Bulletin APSB26-92