Adobe Commerce Exploitation Puts Customer Sessions and Storefront Trust at Risk

Attackers are already attempting to exploit a critical Adobe Commerce and Magento vulnerability that can put customer accounts and private data at risk.

Tracked as CVE-2026-71362, the flaw carries a CVSS score of 9.1 and affects Adobe Commerce and Magento Open Source. Adobe describes it as an incorrect authorization vulnerability that can allow an attacker to gain elevated access to sensitive resources. The attack requires no authentication, administrator privileges, or user interaction.

Adobe released fixes on August 11 as part of security bulletin APSB26-92. At publication, Adobe said it had no evidence of exploitation in the wild. However, subsequent third-party reporting indicated that Sansec’s Shield web application firewall had begun blocking exploitation attempts.

For organizations running internet-facing storefronts, the Magento vulnerability turns patching into an immediate e-commerce security priority.

How does CVE-2026-71362 work?

CVE-2026-71362 falls under CWE-863, or incorrect authorization. In this class of vulnerability, an application performs an authorization check but fails to enforce it correctly.

Adobe classifies the impact as privilege escalation. Its CVSS vector shows a network-accessible, low-complexity attack that requires neither privileges nor user interaction and can cause high confidentiality and integrity impact.

Patch analysis reported by security researchers provides more context. The problem involves how Commerce handles customer identity within an account session. An attacker can potentially switch a session into another customer’s account context, exposing information associated with that account.

That makes the vulnerability particularly dangerous for e-commerce environments. A compromised customer context can expose sensitive information such as personal details and order history. Depending on how an organization has configured and extended its storefront, an account takeover could also affect connected customer and business workflows.

Adobe’s August update also addresses several other Commerce vulnerabilities, including stored cross-site scripting and additional authorization issues. Still, CVE-2026-71362 demands particular attention because an attacker needs no credentials or administrator access to exploit it.

Featured Resource

Cybersecurity kit

Access essential cybersecurity resources to strengthen security, reduce risk, and improve cyber resilience.

Download the Resource Kit

What should enterprises do now?

The first priority is straightforward: patch the affected Commerce environment.

Adobe recommends upgrading supported Adobe Commerce, Adobe Commerce B2B, and Magento Open Source installations to their corresponding August 2026 releases. Organizations should inventory exposed storefronts, confirm their current versions, deploy the appropriate update, and verify successful remediation.

But patching should not end the response.

Security teams should review application, WAF, authentication, and customer-session telemetry for suspicious activity. They should investigate unusual account access, unexpected session changes, anomalous requests, and activity that could indicate attackers moved beyond the initial application flaw.

This incident also demonstrates why enterprise patch management needs defined ownership and aggressive remediation targets for internet-facing systems. When exploitation can happen without authentication, every delay extends the exposure window.

Where Hexnode strengthens the surrounding security posture

CVE-2026-71362 requires Adobe’s application-level fix; endpoint management does not replace that patch. Hexnode UEM can instead help organizations secure and maintain the systems used to access and administer commerce infrastructure.

Hexnode UEM supports centralized patch and update workflows, including automated deployment, scheduling, patch-status visibility, and compliance reporting. Administrators can also define compliance requirements and identify endpoints that fall outside organizational security baselines.

That capability matters for administrator workstations and other managed endpoints surrounding critical commerce operations. Teams can use compliance policies to detect devices that fail configured requirements and connect device posture to access decisions. Hexnode’s integration with Microsoft Entra ID Conditional Access, for example, can use device compliance status when determining whether a device should receive access to organizational resources.

This creates a complementary layer of defense: Adobe’s update closes the Commerce vulnerability, while endpoint compliance, controlled access, and consistent patching reduce weaknesses across the administrative environment.

Conclusion

CVE-2026-71362 shows how quickly a Magento vulnerability can move from vendor disclosure to attempted exploitation.

Organizations running Adobe Commerce or Magento should apply the August 2026 security update immediately and then examine available telemetry for signs of suspicious customer-account activity. They should also treat the incident as a reminder that application security, identity controls, and enterprise patch management cannot operate in isolation.

The objective is not simply to close one vulnerability. It is to reduce the time between disclosure, detection, remediation, and verification before attackers can turn a security flaw into a broader compromise.