INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Adobe Commerce CVE-2026-71362 Exploit Found

| 2026-08-13 17:48 CRITICAL LOW
JSON
Executive Summary AI-generated
The situation is critical as Adobe Commerce CVE-2026-71362, a highly exploited vulnerability, has been under attack shortly after its public disclosure. Hackers have begun targeting the flaw, which could let unauthenticated attackers hijack customer accounts and access private data. The update fixes seven vulnerabilities, including an unauthenticated customer account takeover with a CVSS score of 9.1. Cybersecurity firm Sansec blocked the first exploitation attempts after Adobe published its advisory. The flaw affects Commerce, Commerce B2B, and Magento Open Source versions through July 2026 patches. Adobe has released APSB26-92 as isolated patch files, which are being used to fix the vulnerability.
Technical Mitigations AI-generated
* Use a web application firewall (WAF) like Sansec Shield to block exploitation attempts of CVE-2026-71362, as it is already blocking these attacks. * Implement authentication and administrator privileges requirements for users accessing customer accounts or sensitive resources. * Regularly update Adobe Commerce and Magento versions through the July 2026 patches to ensure you have the latest security fixes. * Monitor your system's logs and network traffic for signs of unauthorized access attempts, which can help identify potential vulnerabilities before they are exploited.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2026-48414CVE-2026-48414 CVE-2026-48412CVE-2026-48412 CVE-2026-71362CVE-2026-71362 CVE-2026-48415CVE-2026-48415 CVE-2026-48413CVE-2026-48413 CVE-2026-48416CVE-2026-48416 CVE-2026-48411CVE-2026-48411
Target & Sectors
Global Scope
Incident Timeline
‎July 2026
Threat actors used Adobe's APSB26-92 patch files to target Commerce and Magento Open Source versions through the July 2026 patches.
organisation Commerce
The flaw affects Commerce, Commerce B2B and Magento Open Source versions through the July 2026 patches .
organisation Magento Open Source
The flaw affects Commerce, Commerce B2B and Magento Open Source versions through the July 2026 patches .
infrastructure 9.1
The update fixes seven vulnerabilities, including an unauthenticated customer account takeover with a CVSS score of 9.1.
organisation CVSS
The update fixes seven vulnerabilities, including an unauthenticated customer account takeover with a CVSS score of 9.1.
organisation Magento
Adobe fixed how Magento handles customer identity in account sessions.
organisation SecurityAffairs
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, Adobe)
‎2026/08/11
Threat actors exploited the Adobe Commerce CVE-2026-71362 vulnerability to gain elevated access to sensitive resources.
organisation Adobe
The flaw is described as an incorrect authorization vulnerability that could be leveraged to "gain elevated access to sensitive resources" without authentication and is one of the seven issues that Adobe addressed in a security update yesterday.
vulnerability CVE-2026-48414
Four of the other flaws Adobe fixed with yesterday's updates received a high-severity score, and the other two are medium and low severity: CVE-2026-48414 (7.7, high severity): Stored cross-site scripting vulnerability that could result in arbitrary code execution.
infrastructure 7.7
Four of the other flaws Adobe fixed with yesterday's updates received a high-severity score, and the other two are medium and low severity: CVE-2026-48414 (7.7, high severity): Stored cross-site scripting vulnerability that could result in arbitrary code execution.
‎2026/08/13
Hackers began targeting a critical Adobe Commerce flaw that could let unauthenticated attackers hijack customer accounts and access private data.
organisation Adobe Commerce CVE-2026-71362 Comes
Adobe Commerce CVE-2026-71362 Comes Under Attack Shortly After Public Disclosure.
organisation Adobe Commerce
Adobe Commerce CVE-2026-71362 Comes Under Attack Shortly After Public Disclosure Hackers began targeting a critical Adobe Commerce flaw that could let unauthenticated attackers hijack customer accounts and access private data.
Hackers exploit critical Adobe Commerce flaw to hijack customer accounts.
organisation Magento
Attempts to exploit a critical vulnerability (CVE-2026-71362) in Adobe's Commerce and Magento e-commerce platforms have been detected, potentially allowing attackers to hijack customer accounts.
organisation Adobe's Commerce
Attempts to exploit a critical vulnerability (CVE-2026-71362) in Adobe's Commerce and Magento e-commerce platforms have been detected, potentially allowing attackers to hijack customer accounts.
organisation Sansec
Although the software vendor states in the advisory that it is not aware of exploits in the wild for any of the fixed flaws, eCommerce security company Sansec says that its Shield web application firewall (WAF) is already blocking CVE-2026-71362 exploitation attempts.
Cybersecurity firm Sansec blocked the first exploitation attempts after Adobe published its advisory.
organisation Shield
Although the software vendor states in the advisory that it is not aware of exploits in the wild for any of the fixed flaws, eCommerce security company Sansec says that its Shield web application firewall (WAF) is already blocking CVE-2026-71362 exploitation attempts.
organisation CVE-2026
Although the software vendor states in the advisory that it is not aware of exploits in the wild for any of the fixed flaws, eCommerce security company Sansec says that its Shield web application firewall (WAF) is already blocking CVE-2026-71362 exploitation attempts.
organisation Cybersecurity
Cybersecurity firm Sansec blocked the first exploitation attempts after Adobe published its advisory.
organisation Adobe
Cybersecurity firm Sansec blocked the first exploitation attempts after Adobe published its advisory.
organisation CVE-2026-48412
CVE-2026-48412 (2.7, low severity): Incorrect-authorization vulnerability that could result in privilege escalation.
organisation CVE-2026-48413
CVE-2026-48413 (8.7, high severity): Stored cross-site scripting vulnerability that could result in arbitrary code execution.
organisation CVE-2026-48415
CVE-2026-48415 (7.6, high severity): Incorrect-authorization vulnerability affecting Adobe Commerce B2B that could enable a security-feature bypass.
organisation CVE-2026-48416
CVE-2026-48416 (7.5, high severity): Incorrect-authorization vulnerability that could enable a security-feature bypass.
organisation CVE-2026-48411
CVE-2026-48411 (6.5, medium severity): Incorrect-authorization vulnerability that could enable a security-feature bypass.
organisation Adobe’s
" After analyzing Adobe’s patch, the researchers pinned the problem to Magento improperly handling customer identity in an account session.
organisation The Blue Report 2026
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
‎August 2026
Threat actors exploited CVE-2026-71362 in Adobe Commerce, compromising affected systems shortly after public disclosure.
organisation Commerce
Website administrators are advised to apply the August 2026 security update for currently supported Commerce, Commerce B2B, and Magento release lines as soon as possible.
Tactical Metrics
Metrics
infrastructure
‎9.1
Software Version
The update fixes seven vulnerabilities, including an unauthenticated customer account takeover with a CVSS score of 9.1.
Metrics
infrastructure
‎7.7
Software Version
Four of the other flaws Adobe fixed with yesterday's updates received a high-severity score, and the other two are medium and low severity: CVE-2026-48414 (7.7, high severity): Stored cross-site scripting vulnerability that could result in arbitrary code execution.
Intelligence Sources
BleepingComputer 2026-08-12
Security Affairs 2026-08-13