High cybersecurity update: Hackers exploit critical Adobe Commerce flaw to hijack customer accounts. The report references CVE-2026-71362. NetworkFix reviewed the available source material to summarize the security issue, its potential impact and the defensive actions administrators should prioritize.
What Happened
Attempts to exploit a critical vulnerability (CVE-2026-71362) in Adobe's Commerce and Magento e-commerce platforms have been detected, potentially allowing attackers to hijack customer accounts. […] Hackers exploit critical Adobe Commerce flaw to hijack customer accounts Attempts to exploit a critical vulnerability (CVE-2026-71362) in Adobe's Commerce and Magento e-commerce platforms have been detected, potentially allowing attackers to hijack customer accounts. The flaw is described as an incorrect authorization vulnerability that could be leveraged to "gain elevated access to sensitive resources" without authentication and is one of the seven issues that Adobe addressed in a security update yesterday. Although the software vendor states in the advisory that it is not aware of exploits in the wild for any of the fixed flaws, eCommerce security company Sansec says that its Shield web application firewall (WAF) is already blocking CVE-2026-71362 exploitation attempts. According to Sansec, exploiting the vulnerability requires "no existing account, administrator privileges or user interaction." After analyzing Adobe’s patch, the researchers pinned the problem to Magento improperly handling customer identity in an account session. "Sansec reviewed the patch and confirmed that the vulnerability lets attackers switch a customer session to another customer account. This gives them access to the victim's account and private customer data," the security company explains . Four of the other flaws Adobe fixed with yesterday's updates received a high-severity score, and the other two are medium and low severity: CVE-2026-48414 (7.7, high severity): Stored cross-site scripting vulnerability that could result in arbitrary code execution.
Technical Details
The vulnerability identifiers associated with this report are CVE-2026-71362. Exploitation requires authentication and administrator privileges. CVE-2026-48413 (8.7, high severity): Stored cross-site scripting vulnerability that could result in arbitrary code execution. CVE-2026-48415 (7.6, high severity): Incorrect-authorization vulnerability affecting Adobe Commerce B2B that could enable a security-feature bypass. CVE-2026-48416 (7.5, high severity): Incorrect-authorization vulnerability that could enable a security-feature bypass. CVE-2026-48411 (6.5, medium severity): Incorrect-authorization vulnerability that could enable a security-feature bypass. CVE-2026-48412 (2.7, low severity): Incorrect-authorization vulnerability that could result in privilege escalation. Website administrators are advised to apply the August 2026 security update for currently supported Commerce, Commerce B2B, and Magento release lines as soon as possible. According to Sansec, these monthly fixes are distributed as isolated patch files rather than a new security release or updated Composer packages. Website admins must first ensure they’re running the latest -p release available for their supported release branch before applying the corresponding isolated patch.
Security Impact
Organizations using the affected technology should treat the report according to its high severity classification. The presence of a tracked CVE gives defenders a concrete identifier to use when checking vendor advisories, vulnerability scanners, asset inventories and patch-management systems. Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Max severity Adobe ColdFusion flaw now exploited in attacks Cisco warns of ASA and FTD VPN flaw exploited to crash devices Sonicwall warns of new SMA1000 zero-day exploited in attacks Critical Progress LoadMaster flaw now actively exploited in attacks N-able warns of N-central auth bypass flaw exploited in attacks Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days LexisNexis shuts down services after suspicious activity on servers Delta probes Wi-Fi deauth attack on flight carrying DEF CON attendees See how Skyhigh Security's patent-pending approach secures every browser session without costly and clunky enterprise browser replacements. See how real inboxes, fake stores and AI scams shaped H1 2026 cyber threats Overdue a password health-check? Audit your Active Directory for free Pixellot discovered and secured hundreds of unmanaged AI agent identities in weeks, not months.
Recommended Actions
- Identify whether the affected product, service or software is present in the environment.
- Review the original vendor or research advisory and verify affected versions before making configuration changes.
- Apply vendor-provided security updates or mitigations as soon as operationally practical.
- Review relevant security logs and monitoring alerts for signs of suspicious activity associated with the reported issue.
- Use the CVE identifiers, where available, to validate exposure through vulnerability-management and asset-inventory tools.
Security Details
- Severity: High
- CVE: CVE-2026-71362
- CISA KEV: No match detected in the current catalog.
- Original source: BleepingComputer
Why This Matters
Cybersecurity teams should use reports like this as an input to risk-based vulnerability and threat management rather than relying on headline severity alone. Exposure depends on whether the affected technology is deployed, reachable by an attacker and protected by compensating controls. Confirming asset ownership, affected versions and available vendor fixes helps teams prioritize remediation while avoiding unnecessary emergency changes.
Original Report
NetworkFix recommends reviewing the complete original report from BleepingComputer for the authoritative technical context, affected versions, indicators and vendor-specific remediation details: Read the original report.
