Published Security3 min read
Adobe Says No Evidence of Exploitation; Sansec Says It Was Already Blocking It
A CVSS 9.1 session-switching bug in Adobe Commerce and Magento drew exploitation attempts as soon as the advisory went up, according to Sansec.
Not a builder's beat, but builders have a standing stake in it.See today for builders
What happened
- CVE-2026-71362 is a critical-severity incorrect authorization vulnerability in Adobe Commerce and Magento that allows unauthenticated attackers to elevate their privileges.
- Adobe resolved CVE-2026-71362 on August 2026 Patch Tuesday and said it had no evidence of in-the-wild exploitation, while warning that threat actors have targeted Commerce before.
- Adobe's advisory states it is not aware of exploits in the wild for any of the flaws fixed in the update, which covered Commerce, Commerce B2B and Magento Open Source.
- eCommerce security company Sansec says its Shield web application firewall is already blocking CVE-2026-71362 exploitation attempts.
- Shortly after Adobe's advisory was published, Sansec warned that it had blocked the first exploitation attempts targeting the CVE; hackers started targeting the flaw immediately after public disclosure.
Compiled by The WatchSomething wrong?How this is made
Why it matters
Adobe fixed a critical incorrect-authorization flaw in Commerce, Commerce B2B and Magento Open Source on its August 2026 Patch Tuesday, stating in the advisory that it was not aware of exploits in the wild for any of the issues it addressed [1][2][3]. Shortly after that advisory went live, e-commerce security firm Sansec said its Shield web application firewall had blocked the first exploitation attempts against the same bug, CVE-2026-71362 [4][5].
Both statements can be true at once, and that is the problem. Adobe's "no known exploitation" reflects what it knew when it shipped; the useful number for a merchant is the interval between publication and the first probe, and according to Sansec that interval was short enough to be operationally meaningless [2][5].
The bug itself is why attackers moved. It carries a CVSS score of 9.1 and lets a remote, unauthenticated attacker elevate privileges [1][6]. Sansec says exploitation requires "no existing account, administrator privileges or user interaction" [7]. After reviewing the patch, the firm concluded the flaw lets an attacker switch a customer session to another customer account, handing over that account and its private customer data [8]. Adobe's fix changes how Commerce and Magento handle customer identity in account sessions, per Sansec's analysis [9]. Everything up to and including the July 2026 patches is affected across all three products [10].
The other six fixes are less urgent by construction. Four are rated high severity, one medium and one low [11][12]. Two stored cross-site scripting flaws, CVE-2026-48413 (8.7) and CVE-2026-48414 (7.7), can lead to arbitrary code execution but need authentication, and in 48414's case administrator privileges [13][14]. The remaining incorrect-authorization issues, CVE-2026-48415 (7.6), CVE-2026-48416 (7.5), CVE-2026-48411 (6.5) and CVE-2026-48412 (2.7), enable security-feature bypass or privilege escalation [15][16][17][18]. Of the seven, only CVE-2026-71362 and CVE-2026-48416 require neither authentication nor admin rights [19].
Then there is the delivery mechanism. According to Sansec, these monthly fixes ship as isolated patch files rather than a new security release or updated Composer packages, and admins must first confirm they are on the latest -p release for their supported branch before applying the corresponding patch [20][21]. Adobe frames the isolated patch as letting merchants "apply the fix in isolation with fewer risks of delay due to potential integration issues" [22]. That is a reasonable design goal, but it still means a version check and a manual patch application on a live storefront while attempts are in flight.
Watch whether Sansec's blocked attempts turn into confirmed compromises on unpatched stores, and whether Adobe updates the advisory's exploitation status. Also watch CVE-2026-48416: it is the other pre-auth bug in the batch, and pre-auth flaws in this codebase have historically been the ones that get weaponised [19][23].
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CVE-2026-71362 is a critical-severity incorrect authorization vulnerability in Adobe Commerce and Magento that allows unauthenticated attackers to elevate their privileges.
- [2]
Adobe resolved CVE-2026-71362 on August 2026 Patch Tuesday and said it had no evidence of in-the-wild exploitation, while warning that threat actors have targeted Commerce before.
- [3]
Adobe's advisory states it is not aware of exploits in the wild for any of the flaws fixed in the update, which covered Commerce, Commerce B2B and Magento Open Source.
- [4]
eCommerce security company Sansec says its Shield web application firewall is already blocking CVE-2026-71362 exploitation attempts.
- [5]
Shortly after Adobe's advisory was published, Sansec warned that it had blocked the first exploitation attempts targeting the CVE; hackers started targeting the flaw immediately after public disclosure.
Sources & coverage · 2 publishers
The reporting this story was synthesized from, earliest first. Every link goes to the original.
- bleepingcomputer.comBill ToulasAug 12Hackers exploit critical Adobe Commerce flaw to hijack customer accounts
- securityweek.comIonut ArghireAug 13Adobe Commerce Bug Targeted Immediately After Disclosure
Additional citations
- SecurityWeek
- BleepingComputer and SecurityWeek
- Sansec, via BleepingComputer
