Adobe fixed Magento account takeover CVE-2026-71362 in August 2026; still in CISA KEV

What happened

On 11 August 2026, Adobe published security bulletin APSB26-92 for Adobe Commerce and Magento Open Source. It includes CVE-2026-71362, an incorrect authorization issue (CWE-863).

Adobe rates it Critical at CVSS 9.1. Exploitation needs no authentication and no user interaction. The impact is privilege escalation.

Sansec reviewed the patch the same day. It said the flaw lets attackers switch a customer session to another customer account. That exposes the victim's account data: PII, orders, addresses and stored payment-related data tied to the account.

This is not new news. Adobe fixed it in the August 2026 isolated patch. We are covering it because stores may still be unpatched, it remains in CISA KEV, and a public GitHub repo claimed an exploit in late October.

Who is affected

Per Adobe APSB26-92:

• Adobe Commerce through the July 2026 isolated-patch level (for example 2.4.9-2026-jul and earlier on supported 2.4.x lines).
• Magento Open Source through the July 2026 isolated-patch level on supported 2.4.x lines.
• Adobe Commerce B2B through the July 2026 isolated-patch level on supported 1.x lines.

Fixed at the matching August 2026 isolated-patch level (*-2026-aug), shipped with APSB26-92. Adobe distributed these as isolated patch files, not a new Composer security package. Merchants typically need the latest -p release for their line before applying the isolated patch.

What is confirmed

• Adobe bulletin APSB26-92, published 11 August 2026 (last updated 18 August 2026 on Adobe's site).
• CVSS 3.1 9.1 Critical; vector published by Adobe and mirrored on CVE.org / NVD.
• CWE-863 Incorrect Authorization; no auth and no user interaction required, per Adobe.
• Sansec confirmed a customer-session identity switch that yields account takeover (11 August 2026 research note).
• Sansec and SecurityWeek reported exploitation attempts shortly after disclosure (SecurityWeek, 13 August 2026). At bulletin time Adobe said it was not aware of in-the-wild exploits.
• CISA KEV listing on 24 September 2026 (due 27 September 2026). Canada's Cyber Centre Update 2 notes the same KEV add.
• NVD published the CVE on 11 August 2026. GitHub Advisory GHSA-f58v-hxr9-8947 tracks it as critical.

What is not confirmed

• How many stores were compromised. Public sources describe attempts and KEV listing, not a merchant count.
• Ransomware use. CISA marks known ransomware campaign use as unknown.
• A confirmed working public PoC. A GitHub repository created on 23 October 2026 claims to be an exploit for this CVE. ThreatWire inspected it read-only and did not execute it. Its affected-version list and timeline do not match Adobe's advisory. We do not treat it as a confirmed PoC and do not publish exploit steps.

What to do

1. Apply the August 2026 isolated patch (or later) for your Adobe Commerce, Magento Open Source or Commerce B2B line, following APSB26-92 and Adobe's release notes.
2. Confirm patch level on every storefront and admin instance. July 2026 and earlier isolated-patch builds remain in scope.
3. Review customer-session and account anomalies since mid-August 2026: unexpected session reuse, odd account access, address or order changes without customer action.
4. Keep a WAF / virtual patch in front of Magento where possible, and keep vendor or third-party Magento rules current.
5. Monitor for account-takeover signals (mass customer data access, unusual GraphQL or account-area traffic from new IPs). Rotate credentials and invalidate sessions if you suspect compromise.
6. Treat payment-related and PII exposure as a privacy incident if takeover is confirmed. Follow your breach and card-brand obligations.

Related coverage

CVE record: CVE-2026-71362. Browse the CVE tracker.

Sources: Adobe APSB26-92, CVE.org, NVD, GitHub Advisory, CISA KEV, Sansec, SecurityWeek, BleepingComputer and the Canadian Centre for Cyber Security. Links are in the references list.