Attackers Exploit Adobe Commerce Flaw After Disclosure

Attackers began exploiting a critical vulnerability in Adobe Commerce, tracked as CVE-2026-71362, shortly after Adobe made details public, webstore security firm Sansec reported. The flaw allows remote, unauthenticated actors to switch a customer session to another account and access that account’s private data.

Sansec blocked the first observed exploitation attempts soon after Adobe published its advisory. The company describes the defect as an incorrect authorization issue and assigns it a CVSS score of 9.1. According to Sansec, attackers can use the vulnerability to take over customer accounts on affected installations.

Adobe released fixes on its August 2026 Patch Tuesday and issued an isolated patch that specifically addresses the Commerce defect along with six other security issues affecting Adobe Commerce, Commerce B2B and Magento Open Source. The company provided installation instructions and urged administrators to apply the updates promptly. Adobe noted it had no evidence of in-the-wild exploitation at the time of the advisory but highlighted that Commerce has been targeted previously.

Sansec reviewed Adobe’s patch and confirmed the technical result. The advisory states: “The vulnerability lets attackers switch a customer session to another customer account. This gives them access to the victim’s account and private customer data.” Adobe’s fix changes how Commerce and Magento validate and handle customer identity within account sessions to prevent session switching.

Adobe warned the set of patched issues could, if exploited, lead to arbitrary code execution, bypassing of security features and privilege escalation. The isolated patch is intended to let merchants apply the Commerce fix independently, reducing the chance of delays caused by integration testing with other updates.

Sansec and Adobe say the vulnerability affects all Commerce, Commerce B2B and Magento Open Source releases up to and including versions that had applied the July 2026 patches. Given the rapid targeting after disclosure, operators running affected versions are advised to install the provided updates and follow Adobe’s installation guidance to reduce the risk of account takeover and data exposure.