---
title: "Adobe Commerce CVE-2026-71362: Exploited Account Takeover"
url: https://erroneo.us/security/briefs/adobe-commerce-magento-cve-2026-71362-account-takeover/
description: "Unauthenticated customer account takeover in Adobe Commerce and Magento Open Source, exploited and in KEV. Fixed by the August 2026 isolated patches. Apply now."
type: security-brief
section: "Security Digest"
date_published: 2026-08-11
date_modified: 2026-09-24
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-71362"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Adobe Commerce CVE-2026-71362: Exploited Account Takeover

**Verdict: Act now.** Any Magento or Adobe Commerce store without the August 2026 isolated patch is exposed to an exploited, login-free takeover of customer accounts; apply it today.

- **Who must act:** Merchants and agencies running Adobe Commerce 2.4.4-2.4.9, Adobe Commerce B2B 1.3.3-1.5.3 or Magento Open Source 2.4.6-2.4.9 at the 2026-jul level or earlier, including staging and campaign sites.
- **Who can relax:** Teams that do not run Magento or Adobe Commerce, and stores whose host or agency has confirmed the August 2026 isolated patch is installed.
- **Affected:** Adobe Commerce 2.4.9, 2.4.8, 2.4.7, 2.4.6, 2.4.5, 2.4.4 (2026-jul and earlier); Adobe Commerce B2B 1.5.3, 1.5.2, 1.4.2, 1.3.4, 1.3.3 (2026-jul and earlier); Magento Open Source 2.4.9, 2.4.8, 2.4.7, 2.4.6 (2026-jul and earlier)
- **Fixed:** Adobe Commerce 2.4.4-2.4.9 2026-aug isolated patches; Adobe Commerce B2B 1.3.3-1.5.3 2026-aug; Magento Open Source 2.4.6-2.4.9 2026-aug isolated patches
- **CVEs:** CVE-2026-71362
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. List every Magento and Adobe Commerce install, including staging, regional and campaign stores, and record the exact release (bin/magento --version).
2. Bring each store to the latest -p release for its line (2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18) with all earlier monthly isolated patches, including July 2026.
3. Apply the matching APSB26-92 isolated patch ZIP from Adobe's KB (Cloud: via the cloud patches update, not both), then flush caches and redeploy.
4. Invalidate all active customer sessions after patching so any hijacked session is dropped.
5. Keep WAF coverage on storefront customer and session endpoints until every store is confirmed patched.

### How to check if you are affected

- Confirm the patch is present with Adobe's patch status tooling (php vendor/bin/patch-status) on every store.
- Review storefront logs and customer support tickets since August 11, 2026 for unexpected session or account switching, changed email addresses or passwords, and unfamiliar addresses or orders.
- Scan stores that were exposed before patching for backdoors and unauthorized admin users, since attackers often chain account access with other bugs.

## What happened

On August 11, 2026, Adobe released bulletin [APSB26-92](https://www.adobe.com/trust/security/products/commerce/apsb26-92) for Adobe Commerce, Commerce B2B and Magento Open Source. It fixes seven vulnerabilities. The most serious is CVE-2026-71362, an incorrect authorization flaw (CWE-863) that Adobe rates Critical with CVSS 3.1 9.1, requiring no authentication. Adobe lists the impact as privilege escalation. The bug was reported by the researcher 0x0.eth. At release, Adobe said it was "not aware of any exploits in the wild."

Adobe published no technical detail. [Sansec](https://sansec.io/research/adobe-commerce-account-takeover-apsb26-92) reviewed the patch the same day. It confirmed that the bug lets an attacker "switch a customer session to another customer account," gaining access to the victim's account and private customer data. Sansec says exploitation needs "no existing account, administrator privileges or user interaction," and that Adobe changed how Magento binds customer identity to the session. Within two days, Sansec reported blocking the first exploitation attempts, according to [Security Affairs](https://securityaffairs.com/197149/hacking/adobe-commerce-cve-2026-71362-comes-under-attack-shortly-after-public-disclosure.html) and [BleepingComputer](https://bleepingcomputer.com/news/security/hackers-exploit-critical-adobe-commerce-flaw-to-hijack-customer-accounts). CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-71362) on September 24, with a federal deadline of September 27. BleepingComputer's [KEV coverage](https://www.bleepingcomputer.com/news/security/cisa-warns-of-sharepoint-wso2-adobe-commerce-flaws-exploited-in-attacks/) cites Sansec as having observed in-the-wild exploitation.

## Who is affected

All supported lines at the "2026-jul" level or earlier are affected: Adobe Commerce 2.4.4 through 2.4.9, Adobe Commerce B2B 1.3.3 through 1.5.3, and Magento Open Source 2.4.6 through 2.4.9. The fix is the "2026-aug" level for each line. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-71362) and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-71362) match the bulletin. Older lines are not listed and get no fix in this bulletin.

The fix is not a normal release. Adobe's [KB article](https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-40380) says it ships as an isolated patch ZIP per release line and is "not available as a Composer package." A store must already be on the latest security release for its line: 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17 or 2.4.4-p18. It must also have every earlier monthly isolated patch applied in order. Stores that are behind face a two-step upgrade.

## Do you really need to act?

If you run a Magento or Adobe Commerce storefront, yes. Storefronts are public by design, the attack needs no login, and exploitation was seen within days of disclosure. This is not known to be server-level code execution. The documented impact is taking over customer accounts and reading their data, such as personal details and order history (per [CyCognito](https://www.cycognito.com/blog/emerging-threat-cve-2026-71362-adobe-commerce-account-takeover-via-session-identity-flaw/)). That is still a personal-data exposure that can trigger breach-notification duties, and hijacked accounts can be abused for fraud. Adobe's own Priority 2 rating predates the KEV listing, so do not read it as a reason to wait.

A separate Magento bug, CVE-2026-75650 (template engine injection), was added to KEV on September 8. It needs its own check. Patching this one does not cover it.

If you do not run Magento or Adobe Commerce, nothing here applies. Agencies should check every client store, not just their own.

## What to do now

1. Find every install and its version: `php bin/magento --version`, or `composer show magento/product-community-edition` (or `magento/product-enterprise-edition`).
2. Move to the latest `-p` release for the line, with all previous isolated patches, including July 2026.
3. Download the line's ZIP (for example `2-4-7-p10-aug-2026.zip`), apply the patches in the order the KB shows, then run `php bin/magento cache:flush` and redeploy. On Adobe Commerce Cloud, use the cloud patches update instead. Adobe warns that applying the isolated patch on top of it can fail.
4. Invalidate customer sessions after patching by flushing the session store (Redis, database or `var/session`, depending on configuration).
5. Until every store is patched, keep WAF rules in front of storefront customer and session endpoints.

## How to tell if you were hit

Verify the patch first with the KB's tooling: `php vendor/bin/patch-status` (Cloud: `vendor/bin/magento-patches -n status`). Public reporting does not name the endpoint or a specific log signature. Look instead for outcomes. These include customers reporting orders, address changes or password resets they did not make, bursts of account email changes, and logins to many customer accounts from the same IPs since August 11. CyCognito also advises scanning stores that were exposed for backdoors added before patching. Check for unknown admin users and modified files under `app/`, `pub/` and `vendor/`. If accounts were taken over, your breach-notification obligations may apply.

## Timeline

- Aug 11, 2026 — Adobe publishes APSB26-92 with no known exploitation. Sansec publishes its patch analysis.
- Aug 12, 2026 — BleepingComputer reports that Sansec's WAF is already blocking exploitation attempts.
- Aug 18, 2026 — Latest update to Adobe's bulletin.
- Sep 24, 2026 — CISA adds CVE-2026-71362 to KEV, with a federal deadline of September 27.

## Sources

1. [Adobe — APSB26-92: Security update available for Adobe Commerce](https://www.adobe.com/trust/security/products/commerce/apsb26-92)
2. [Adobe Experience League — Security update available for Adobe Commerce - APSB26-92](https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-40380)
3. [CVE record — CVE-2026-71362](https://www.cve.org/CVERecord?id=CVE-2026-71362)
4. [NVD — CVE-2026-71362](https://nvd.nist.gov/vuln/detail/CVE-2026-71362)
5. [CISA — Known Exploited Vulnerabilities: CVE-2026-71362](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-71362)
6. [Sansec — Adobe patches critical Magento account takeover (APSB26-92)](https://sansec.io/research/adobe-commerce-account-takeover-apsb26-92)
7. [CyCognito — Emerging threat: CVE-2026-71362 Adobe Commerce account takeover](https://www.cycognito.com/blog/emerging-threat-cve-2026-71362-adobe-commerce-account-takeover-via-session-identity-flaw/)
8. [BleepingComputer — Hackers exploit critical Adobe Commerce flaw to hijack customer accounts](https://bleepingcomputer.com/news/security/hackers-exploit-critical-adobe-commerce-flaw-to-hijack-customer-accounts)
9. [Security Affairs — Adobe Commerce CVE-2026-71362 comes under attack shortly after public disclosure](https://securityaffairs.com/197149/hacking/adobe-commerce-cve-2026-71362-comes-under-attack-shortly-after-public-disclosure.html)
10. [BleepingComputer — CISA warns of SharePoint, WSO2, Adobe Commerce flaws exploited in attacks](https://www.bleepingcomputer.com/news/security/cisa-warns-of-sharepoint-wso2-adobe-commerce-flaws-exploited-in-attacks/)

---
Source page: https://erroneo.us/security/briefs/adobe-commerce-magento-cve-2026-71362-account-takeover/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt