Adobe Commerce and Magento CVE-2026-71362 customer account takeover exploited; apply August 2026 patch
A critical Adobe Commerce and Magento flaw (CVE-2026-71362) lets attackers take over customer accounts with no login. Attacks began right after the August patch and CISA listed it on 24 Sep. Shop owners should apply Adobe's APSB26-92 patch now.
If you run an Adobe Commerce or Magento shop, or ask someone who does, make sure the latest patch level for your release line is installed, then apply the APSB26-92 isolated patch. If you only shop at such stores, nothing to do except watch for odd account activity.
What’s happening
CVE-2026-71362 is a critical flaw (CVSS 9.1) in Adobe Commerce, Commerce B2B and Magento Open Source, the software behind many online shops. Adobe fixed it on 11 August 2026 in bulletin APSB26-92. Per Sansec, which reviewed the patch, an attacker with no account, no admin rights and no user interaction can switch a session to another customer's account and see that person's private details. That differs from the brief for this record, which described an attacker who already has a foothold. Adobe's bulletin said it knew of no attacks at release, but Sansec reported blocking exploitation attempts within a day. Reports say affected shops are those without the August patches. The fix ships as isolated patch files, not a new version. CISA listed the flaw as exploited on 24 September 2026, per the brief and one secondary site. The bulletin page could not be opened for this record, so exact version lists come from press reports. This mainly affects shop operators, and indirectly their customers.
- What
- Flaw
- Affects
- Adobe Commerce, Commerce B2B and Magento Open Source (online shop software)
- Affected
- Adobe Commerce, Commerce B2B and Magento Open Source without the August 2026 security patch (reported as patched only through July 2026)
- Fixed in
- APSB26-92 isolated patch (August 2026) for supported release lines
- Since
- 24 Sept 2026
- Closed
- 24 Sept 2026
Timeline
- CISA added
CISA added CVE-2026-71362 to its list of flaws being used in attacks. This date comes from the brief for this record and a single secondary site; CISA's own page was not read.
- Update
Security Affairs reported the same attacks. It said affected installs are those on Commerce, Commerce B2B and Magento Open Source with patches only up to July 2026.
- Wider attacks
BleepingComputer reported that security firm Sansec was blocking attempts to exploit CVE-2026-71362 within a day of the patch. Sansec said the flaw lets an attacker switch a session to another customer's account with no login.
- Made publicFixed
Adobe published bulletin APSB26-92 with isolated patches for Commerce, Commerce B2B and Magento Open Source. The bulletin covers seven flaws, including the critical CVE-2026-71362, and says Adobe knew of no attacks. The bulletin page itself could not be opened for this record; this is as reported by BleepingComputer.
Sources
- Adobe Security Bulletin APSB26-92 (Magento and Commerce)Adobe · 11 Aug 2026
- Hackers exploit critical Adobe Commerce flaw to hijack customer accountsBleepingComputer · 12 Aug 2026
- Adobe Commerce CVE-2026-71362 comes under attack shortly after public disclosureSecurity Affairs · 13 Aug 2026