2026-08-16 · view entry permalink →
CVE-2026-71362 — Adobe Commerce and Magento Open Source: an unauthenticated attacker switches a customer session to another customer's account (CVSS 9.1), and a WAF vendor reports it is already blocking attempts
Adobe's 2026-08-11 bulletin APSB26-92 fixes seven vulnerabilities in Adobe Commerce, Adobe Commerce B2B and Magento Open Source, five of them rated Critical (Adobe PSIRT, 2026-08-11). The one that matters operationally is CVE-2026-71362, an incorrect-authorization flaw (CWE-863) which Adobe's own vulnerability table scores at CVSS 9.1 and records as requiring no authentication, no administrator privileges and no user interaction (Adobe PSIRT, 2026-08-11). Sansec, which reviewed the patch, describes the effect concretely: the flaw lets an attacker switch a customer session to another customer account, giving access to that account and its private customer data, and Adobe's fix changes the way Magento handles customer identity in the account session (Sansec, 2026-08-11).
The exploitation picture depends on who is speaking, and both readings belong in a triage decision. Adobe states in the bulletin that it is not aware of any exploits in the wild for any issue in the update (Adobe PSIRT, 2026-08-11). Sansec states that its Shield web application firewall already blocks exploitation attempts against this flaw (Sansec, 2026-08-11), and BleepingComputer reports that attempts to exploit CVE-2026-71362 have been detected (BleepingComputer, 2026-08-12). Nobody reports a confirmed compromised store, so this sits between "patched, quiet" and "actively exploited" — which for a pre-authentication account takeover on an internet-facing storefront is close enough to the latter to act on.
The deployment detail is what will actually cost teams time. APSB26-92 ships as isolated patch files rather than a new security release or new Composer packages, and merchants must be running the latest -p release for their supported release line before the corresponding isolated patch can be applied (Sansec, 2026-08-11). A store several -p releases behind therefore has a two-step upgrade in front of it, not a patch. The affected ranges differ by product and the difference matters for inventory: Adobe Commerce is listed from 2.4.9-2026-jul down to 2.4.4-2026-jul, Adobe Commerce B2B from 1.5.3-2026-jul down to 1.3.3-2026-jul, and Magento Open Source only from 2.4.9-2026-jul down to 2.4.6-2026-jul, each "and earlier", with the fixes in the corresponding -2026-aug builds of each line (Adobe PSIRT, 2026-08-11).
For this constituency the exposure is narrower than a general Magento advisory suggests but is real: public-sector bodies that run ticketing, publication or fee-payment storefronts on Commerce or Magento hold exactly the customer records this flaw hands over, and the payment-adjacent data in those accounts is what makes a session takeover worth automating.
Detection, in vendor-neutral terms: because the flaw operates on session identity rather than injecting code, the signal is in application and web-access logs rather than on the host. Look for requests where a session identifier is presented against a customer account other than the one it was issued to, for a single session identifier or source address touching multiple distinct customer account contexts in quick succession, and for account-area page views and order-history reads that arrive without the preceding authentication sequence that normally establishes them. There is no file to find and no process to spot — a successful attack looks like an ordinary logged-in customer, which is why the post-patch session invalidation matters as much as the patch.
Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.
Sansec reviewed the patch and confirmed that the vulnerability lets attackers switch a customer session to another customer account. This gives them access to the victim's account and private customer data.
Sansec Shield already blocks exploitation attempts.