Adobe Commerce CVE-2026-71362: Exploited Account Takeover

What to do

1. List every Magento and Adobe Commerce install, including staging, regional and campaign stores, and record the exact release (bin/magento --version).
2. Bring each store to the latest -p release for its line (2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18) with all earlier monthly isolated patches, including July 2026.
3. Apply the matching APSB26-92 isolated patch ZIP from Adobe's KB (Cloud: via the cloud patches update, not both), then flush caches and redeploy.
4. Invalidate all active customer sessions after patching so any hijacked session is dropped.
5. Keep WAF coverage on storefront customer and session endpoints until every store is confirmed patched.

How to check if you are affected or compromised

• Confirm the patch is present with Adobe's patch status tooling (php vendor/bin/patch-status) on every store.
• Review storefront logs and customer support tickets since August 11, 2026 for unexpected session or account switching, changed email addresses or passwords, and unfamiliar addresses or orders.
• Scan stores that were exposed before patching for backdoors and unauthorized admin users, since attackers often chain account access with other bugs.

What happened#

On August 11, 2026, Adobe released bulletin APSB26-92 for Adobe Commerce, Commerce B2B and Magento Open Source. It fixes seven vulnerabilities. The most serious is CVE-2026-71362, an incorrect authorization flaw (CWE-863) that Adobe rates Critical with CVSS 3.1 9.1, requiring no authentication. Adobe lists the impact as privilege escalation. The bug was reported by the researcher 0x0.eth. At release, Adobe said it was "not aware of any exploits in the wild."

Adobe published no technical detail. Sansec reviewed the patch the same day. It confirmed that the bug lets an attacker "switch a customer session to another customer account," gaining access to the victim's account and private customer data. Sansec says exploitation needs "no existing account, administrator privileges or user interaction," and that Adobe changed how Magento binds customer identity to the session. Within two days, Sansec reported blocking the first exploitation attempts, according to Security Affairs and BleepingComputer. CISA added the CVE to the KEV catalog on September 24, with a federal deadline of September 27. BleepingComputer's KEV coverage cites Sansec as having observed in-the-wild exploitation.

Who is affected#

All supported lines at the "2026-jul" level or earlier are affected: Adobe Commerce 2.4.4 through 2.4.9, Adobe Commerce B2B 1.3.3 through 1.5.3, and Magento Open Source 2.4.6 through 2.4.9. The fix is the "2026-aug" level for each line. The CVE record and NVD match the bulletin. Older lines are not listed and get no fix in this bulletin.

The fix is not a normal release. Adobe's KB article says it ships as an isolated patch ZIP per release line and is "not available as a Composer package." A store must already be on the latest security release for its line: 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17 or 2.4.4-p18. It must also have every earlier monthly isolated patch applied in order. Stores that are behind face a two-step upgrade.

Do you really need to act?#

If you run a Magento or Adobe Commerce storefront, yes. Storefronts are public by design, the attack needs no login, and exploitation was seen within days of disclosure. This is not known to be server-level code execution. The documented impact is taking over customer accounts and reading their data, such as personal details and order history (per CyCognito). That is still a personal-data exposure that can trigger breach-notification duties, and hijacked accounts can be abused for fraud. Adobe's own Priority 2 rating predates the KEV listing, so do not read it as a reason to wait.

A separate Magento bug, CVE-2026-75650 (template engine injection), was added to KEV on September 8. It needs its own check. Patching this one does not cover it.

If you do not run Magento or Adobe Commerce, nothing here applies. Agencies should check every client store, not just their own.

What to do now#

1. Find every install and its version: php bin/magento --version, or composer show magento/product-community-edition (or magento/product-enterprise-edition).
2. Move to the latest -p release for the line, with all previous isolated patches, including July 2026.
3. Download the line's ZIP (for example 2-4-7-p10-aug-2026.zip), apply the patches in the order the KB shows, then run php bin/magento cache:flush and redeploy. On Adobe Commerce Cloud, use the cloud patches update instead. Adobe warns that applying the isolated patch on top of it can fail.
4. Invalidate customer sessions after patching by flushing the session store (Redis, database or var/session, depending on configuration).
5. Until every store is patched, keep WAF rules in front of storefront customer and session endpoints.

How to tell if you were hit#

Verify the patch first with the KB's tooling: php vendor/bin/patch-status (Cloud: vendor/bin/magento-patches -n status). Public reporting does not name the endpoint or a specific log signature. Look instead for outcomes. These include customers reporting orders, address changes or password resets they did not make, bursts of account email changes, and logins to many customer accounts from the same IPs since August 11. CyCognito also advises scanning stores that were exposed for backdoors added before patching. Check for unknown admin users and modified files under app/, pub/ and vendor/. If accounts were taken over, your breach-notification obligations may apply.

Timeline#

• Aug 11, 2026 — Adobe publishes APSB26-92 with no known exploitation. Sansec publishes its patch analysis.
• Aug 12, 2026 — BleepingComputer reports that Sansec's WAF is already blocking exploitation attempts.
• Aug 18, 2026 — Latest update to Adobe's bulletin.
• Sep 24, 2026 — CISA adds CVE-2026-71362 to KEV, with a federal deadline of September 27.

Vulnerability records

• CVE-2026-71362 · KEV 2026-09-24 · Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Adobe — APSB26-92: Security update available for Adobe Commerce adobe.com
2. Adobe Experience League — Security update available for Adobe Commerce - APSB26-92 experienceleague.adobe.com
3. CVE record — CVE-2026-71362 cve.org
4. NVD — CVE-2026-71362 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2026-71362 cisa.gov
6. Sansec — Adobe patches critical Magento account takeover (APSB26-92) sansec.io
7. CyCognito — Emerging threat: CVE-2026-71362 Adobe Commerce account takeover cycognito.com

Coverage and analysis

1. BleepingComputer — Hackers exploit critical Adobe Commerce flaw to hijack customer accounts bleepingcomputer.com
2. Security Affairs — Adobe Commerce CVE-2026-71362 comes under attack shortly after public disclosure securityaffairs.com
3. BleepingComputer — CISA warns of SharePoint, WSO2, Adobe Commerce flaws exploited in attacks bleepingcomputer.com