Adobe Commerce Critical Auth Flaw Exploited Within Hours of Patching

Marcus Chen Staff Engineer, Backend & Cloud, YuSMP Group · Infrastructure security and cloud architecture for US/EU products

What CVE-2026-71362 actually does

The vulnerability is classified as an incorrect authorization flaw. In practice, it allows an unauthenticated HTTP request to switch the active session context from one customer account to another — no password, no token, no prior login required. An attacker who exploits it gains full access to the victim customer's profile: order history, saved shipping addresses, wishlist items, and any stored payment tokens that the store exposes through the session.

For Magento development teams and merchants running Adobe Commerce, the blast radius is broad. Any store that handles customer accounts — which is most B2C and B2B storefronts — is a target. The vulnerability affects all three product lines: Adobe Commerce, Commerce B2B, and Magento Open Source, across all versions through the July 2026 update.

Adobe's own advisory rated the vulnerability Critical and assigned a CVSS score in the 9.1–9.8 range (scores vary by scorer; both SecurityWeek and BleepingComputer confirmed Critical severity). No authentication is required. No user interaction is needed. The attack complexity is low.

Why exploitation was so fast

Adobe published its advisory on August 12, 2026 — standard Patch Tuesday timing. At the same time, it stated that no known in-the-wild exploitation had been observed. Within hours, that statement was outdated.

Sansec, a firm specializing in Magento security, reported that its web application firewall was already blocking exploitation attempts against Commerce and Magento stores before the patch cycle had meaningfully propagated across the merchant base. This is a pattern sometimes called "Patch Tuesday to exploit Wednesday" — and it is not unique to this disclosure, but it is particularly acute for widely deployed open-source platforms like Magento where the patch mechanics (applying an isolated patch on top of the latest -p release) require manual operator effort rather than an auto-update.

The gap between "advisory published" and "exploitation begins" is narrowing across the industry. For e-commerce operators, this means treating any Critical CVE against a customer-facing platform as a same-day patching obligation, not a next-maintenance-window task.

What else was fixed in August 2026

The August 2026 release addressed four additional vulnerabilities alongside CVE-2026-71362:

• CVE-2026-48413 (CVSS 8.7) — Stored cross-site scripting in Commerce, exploitable without admin privileges. Allows attackers to inject persistent malicious scripts into storefront output.
• CVE-2026-48414 (CVSS 7.7) — Stored XSS with code execution potential. Higher impact but requires some privilege level to inject.
• CVE-2026-48415 (CVSS 7.6) — Authorization bypass specific to Commerce B2B. Affects merchants using the company account and purchase order features.
• CVE-2026-48416 (CVSS 7.5) — Unauthenticated authorization bypass. Separate from CVE-2026-71362; details suggest a different code path for session or permission handling.

Adobe distributes the fix as an isolated patch file that must be applied on top of the latest -p release of Commerce or Magento Open Source. Stores that are not on the latest -p release must upgrade to it before the isolated patch can be applied.

What it means for US & EU e-commerce teams

For engineering and security teams operating e-commerce platforms in the US and EU, this incident highlights three structural issues beyond the immediate patch obligation:

Session architecture is a first-class security concern. The fact that a session can be switched between customers without authentication suggests a gap in how session tokens are tied to identity at the application layer. Even after patching, it is worth auditing whether your Commerce implementation uses any customizations — extensions, third-party plugins, headless API integrations — that could re-introduce similar session handling flaws.

GDPR and PCI DSS exposure is real. An unauthenticated attacker who can view another customer's order history and saved addresses has accessed personal data without authorization — a reportable incident under GDPR Article 33 if there is any evidence of actual access. Merchants in the EU should assess whether the exploitation window overlaps with active attack traffic and whether the 72-hour notification clock has started. PCI DSS 4.0 similarly requires prompt assessment of incidents that affect cardholder data environments.

WAF coverage is not a substitute for patching — but it buys time. Sansec's ability to block exploitation before patches were widely deployed illustrates that a well-configured WAF rule targeting the specific request pattern can reduce exposure during a patch window. It is not a permanent fix, but for merchants with complex upgrade dependencies, a temporary WAF rule targeting session-override patterns is a reasonable interim measure while the patch is scheduled.

Remediation checklist

These are the minimum steps for any team running Adobe Commerce or Magento Open Source:

1. Confirm your current version. Run bin/magento --version or check the Admin panel. Identify whether you are on the latest -p release for your minor version.
2. Upgrade to the latest -p release if you are not already on it. The isolated August patch cannot be applied to older -p releases.
3. Apply the August 2026 isolated security patch. Follow Adobe's official patch instructions; the process differs by Commerce version. Test in staging before deploying to production.
4. If running Commerce B2B, apply the B2B-specific fixes for CVE-2026-48415 and CVE-2026-48416 — these are separate from the main Commerce patch file.
5. Review your WAF and server logs for anomalous session-switching patterns from the August 12–15 window. If you see evidence of exploitation, begin GDPR incident assessment immediately.
6. Audit third-party extensions that modify session or customer identity handling — these are the most common vector for re-introducing fixed vulnerabilities in customized deployments.

Frequently asked questions

Sources

BleepingComputer — Hackers exploit critical Adobe Commerce flaw to hijack customer accounts, August 2026
SecurityWeek — Adobe Commerce Bug Targeted Immediately After Disclosure, August 2026