Hackers wasted no time in targeting a critical vulnerability in Adobe Commerce, a flaw that was disclosed publicly and immediately drew attention from cybercriminals. Security firm Sansec reported that the vulnerability, identified as CVE-2026-71362 with a CVSS score of 9.1, was exploited soon after Adobe published its advisory. This security defect, classified as an incorrect authorization issue, allows unauthorized attackers to elevate their privileges and potentially gain control over customer accounts.
Adobe released a patch on August 2026 Patch Tuesday to resolve the issue, which had not yet been exploited in the wild according to their initial findings. However, the rapid targeting of this flaw by hackers prompted Sansec to emphasize the urgency of applying the patch. The vulnerability allows remote attackers to take over customer accounts by switching sessions, thereby accessing private data and potentially causing significant harm.
The patch issued by Adobe modifies how Commerce and Magento handle customer identity during account sessions. This change is designed to prevent unauthorized access and safeguard sensitive customer information. The vulnerability impacts all versions of Commerce, Commerce B2B, and Magento Open Source up to the July 2026 patches. In response, Adobe has provided an isolated patch to address this critical flaw, alongside fixes for six other security issues.
Adobe strongly advises merchants to apply the latest security updates immediately. Failure to do so could lead to severe consequences such as arbitrary code execution, security feature bypass, and privilege escalation. The company has also made the patch available as an isolated fix, minimizing potential delays due to integration issues. This ensures a smoother update process and enhances the security posture of all affected systems.