Critical vulnerability in Adobe Commerce and Magento puts store customer accounts at risk

On servers running Adobe Commerce and Magento Open Source stores, an authorization flaw that does not require authentication has been identified. The vulnerability, tracked as CVE-2026-71362, is critical with a CVSS score of 9.1. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its list of actively exploited vulnerabilities on September 24 and flagged it as used in ransomware campaigns.

The vulnerability was disclosed in Adobe’s security bulletin APSB26-92 dated August 11, 2026. The bulletin covers seven vulnerabilities in the same package. CVE-2026-71362 became the most notable member of the group due to both its score and ease of exploitation.

No password required to switch sessions

The flaw is in the authorization layer of the store software. The incorrect authorization in the CWE-863 class stems from access controls not being enforced on a network-accessible endpoint. Adobe’s vector values are AV:N/AC:L/PR:N/UI:N: the attacker does not need their own account or admin privileges, nor is a store visitor expected to click a link.

The result is privilege escalation. Someone exploiting the vulnerability can move from one customer session to another and access the store’s sensitive resources. Security firm Sansec reported that it was used in real attacks shortly after the vulnerability was disclosed.

Affected versions

Installations at risk are versions running at the July 2026 patch level:

• Adobe Commerce 2.4.4 through 2.4.9
• Adobe Commerce B2B 1.3.3 through 1.5.3
• Magento Open Source 2.4.6 through 2.4.9

How to update

The fix was released with the August 2026 security updates. For Adobe Commerce, the target versions are 2.4.9-2026-aug through 2.4.4-2026-aug; on the Magento Open Source side, they are 2.4.9-2026-aug and 2.4.6-2026-aug. Stores running on Adobe Commerce Cloud receive the fix through the cloud patch package.

Those hosting Adobe Commerce or Magento on their own server complete the update by running the bin/magento setup:upgrade command after switching to the relevant version with Composer. For stores that don’t want to jump a full version, Adobe also released isolated patch files. These files work only on the latest -p release of their own release line and if the previous monthly isolated patches have been applied in order.

It also affects shoppers

The vulnerability concerns not only the store’s server but also people who have accounts at that store. A hijacked session means access to order history and account information. The remediation deadline CISA grants public agencies for vulnerabilities on its list expires on September 27; private-sector stores have no such obligation, but exploitation cases have already been seen.

Store owners running Adobe Commerce or Magento Open Source should apply the patch without waiting and, after updating, review admin accounts and order records. On the user side, it would be wise for shopping accounts that use the same password on different sites to change their passwords and check account activity.

Source: CISA KEV · NVD