Illustrative image generated with AI
Adobe Commerce and Magento Under Attack: CVE-2026-71362 Exploited
Critical CVE-2026-71362 exploit attempts target Adobe Commerce and Magento. Learn about the flaw and security update for admins.
Text generated by artificial intelligence, published without human review. AI transparency
Attempts to Exploit a Critical Flaw Detected
On August 12, 2026, attempts to exploit CVE-2026-71362, a critical vulnerability in Adobe Commerce and Magento, were detected.
The flaw involves an authorization error that could allow an unauthenticated attacker to access sensitive resources and compromise customer accounts. No existing account, administrative privileges, or user interaction are required.
Sansec stated that its Shield WAF is blocking the observed attempts. Adobe, however, says it is not aware of active exploitation of the vulnerabilities addressed by the update. At this time, there is no indication that the detected attacks resulted in successful compromises.
How the Customer Session Attack Works
Patch analysis indicates improper handling of customer identity within the session. An attacker may attempt to associate their own session with another customer’s account, gaining access to the associated profile and private data.
The issue is particularly significant for online stores, as a successful attack could expose personal information and provide access to accounts without legitimate authentication.
The exact affected versions have not been disclosed. Supported lines of Adobe Commerce, Adobe Commerce B2B, and Magento are affected.
The Seven Vulnerabilities Addressed
The August 2026 security update addresses seven issues:
| Identifier | Severity | Impact and Requirements |
|---|---|---|
| CVE-2026-71362 | Critical | Improper authorization, unauthenticated access to sensitive resources, and potential compromise of customer accounts. |
| CVE-2026-48414 | High, CVSS 7.7 | Persistent XSS with potential arbitrary code execution; requires authentication and administrative privileges. |
| CVE-2026-48413 | High, CVSS 8.7 | Persistent XSS and potential arbitrary code execution; requires authentication but not administrative privileges. |
| CVE-2026-48415 | High, CVSS 7.6 | Improper authorization in Adobe Commerce B2B; requires authentication but not administrative privileges. |
| CVE-2026-48416 | High, CVSS 7.5 | Improper authorization and potential security feature bypass; does not require authentication. |
| CVE-2026-48411 | Medium, CVSS 6.5 | Improper authorization and potential security feature bypass; requires authentication and administrative privileges. |
| CVE-2026-48412 | Low, CVSS 2.7 | Improper authorization with potential privilege escalation; requires authentication and administrative privileges. |
What Administrators Should Do
Operators should promptly apply the August 2026 security update to supported Commerce, Commerce B2B, and Magento releases.
The fixes are distributed as isolated patches, not as a new security release or updated Composer packages. Before installation, verify that the environment is running the latest available “-p” release for the supported branch.
Organizations should also maintain or implement WAF rules capable of blocking attempts associated with CVE-2026-71362. Sansec Shield is already applying this type of protection. They should additionally review authentication and customer-account access logs, focusing on anomalous session associations and access that cannot be attributed to legitimate users.
Sources
This article is an original reworking based on the sources below.
CVEs covered in this article
- CVE-2026-71362CRITICAL9.1Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.
- CVE-2026-48413HIGH8.7Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable
- CVE-2026-48414HIGH7.7Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable
- CVE-2026-48415HIGH7.6Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability. Ex
- CVE-2026-48416HIGH7.5Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.
- CVE-2026-48411MEDIUM6.5Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user i
- CVE-2026-48412LOW2.7Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to restricted resources. Exploitation of this issue does not require user interaction.