Skip to content
THREATWIRE
CriticalActive ExploitationKEV

CVE-2026-71362

Adobe Commerce and Magento Open Source incorrect authorization, customer account takeover

Incorrect authorization (CWE-863) in Adobe Commerce, Adobe Commerce B2B and Magento Open Source lets an unauthenticated attacker escalate privileges and switch a customer session to another customer's account. Adobe rates it Critical, CVSS 3.1 9.1. Fixed in the August 2026 isolated patch (APSB26-92). Sansec reported exploitation attempts shortly after disclosure. CISA added it to KEV on 24 September 2026.

By ThreatWire Desk · Published 11 Aug 2026 · Updated 24 Oct 2026

CVSS
9.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Class
Auth bypass
Status
Active Exploitation
KEV
Listed in CISA KEV
0-day
No
Vendor
Adobe
Products
Adobe Commerce, Adobe Commerce B2B, Magento Open Source
Affected
Adobe Commerce 2.4.9-2026-jul and earlier, 2.4.8-2026-jul and earlier, 2.4.7-2026-jul and earlier, 2.4.6-2026-jul and earlier, 2.4.5-2026-jul and earlier, 2.4.4-2026-jul and earlier. Magento Open Source 2.4.9-2026-jul and earlier through 2.4.6-2026-jul and earlier. Adobe Commerce B2B 1.5.3-2026-jul and earlier through 1.3.3-2026-jul and earlier. Per Adobe APSB26-92.
Fixed
August 2026 isolated patch level from APSB26-92: Adobe Commerce 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug; Magento Open Source 2.4.9-2026-aug through 2.4.6-2026-aug; Adobe Commerce B2B 1.5.3-2026-aug through 1.3.3-2026-aug. Bulletin published 11 August 2026.
CWE
CWE-863
Published
11 Aug 2026
Updated
24 Oct 2026

The status above is the claim. Links do not upgrade it.

CVE-2026-71362 is an incorrect authorization flaw (CWE-863) in Adobe Commerce, Adobe Commerce B2B and Magento Open Source. Adobe published it in APSB26-92 on 11 August 2026.

Adobe rates it Critical with CVSS 3.1 9.1. The full vector is in the CVSS field. Exploitation needs no authentication and no user interaction, per Adobe. Impact is privilege escalation. Sansec reviewed the patch and said attackers can switch a customer session to another customer account, exposing that account's private data.

Affected builds run through the July 2026 isolated-patch level. The fix is the matching August 2026 isolated patch (*-2026-aug). Adobe distributed APSB26-92 as isolated patch files, not a new Composer security release.

At bulletin time Adobe said it was not aware of in-the-wild exploits. Sansec reported blocking exploitation attempts shortly after disclosure. CISA added the CVE to the Known Exploited Vulnerabilities catalog on 24 September 2026 (federal due date 27 September 2026). Known ransomware use is unknown.

A public GitHub repository created on 23 October 2026 claims to be an exploit for this CVE. ThreatWire inspected it read-only and did not run it. Version and timeline details in that repo do not match Adobe's advisory. This record does not set a confirmed PoC URL.

Read the full story and defensive checklist.

Sources

Related on ThreatWire

Share on X@threatwire_https://www.threatwire.tech/cve/cve-2026-71362