Hackers exploit critical Adobe Commerce flaw to hijack customer accounts

Adobe's August 11, 2026 bulletin APSB26-92 fixed seven flaws across Adobe Commerce, Adobe Commerce B2B and Magento Open Source, five rated critical, and one is under active attack. CVE-2026-71362 is an incorrect authorization bug, CWE-863, scored 9.1 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Sansec's patch review pinned the mechanism to Magento mishandling customer identity inside the account session: a remote attacker with no account, no admin rights and no user interaction can switch a session onto another customer's account and read that account's private data. Adobe credited researcher 0x0.eth and said it knew of no exploitation at publication, yet Sansec's Shield WAF was blocking CVE-2026-71362 attempts the same day the advisory landed. Every supported line up to and including the July 2026 patches is affected: Adobe Commerce 2.4.4-p18 through 2.4.9, B2B 1.3.3 through 1.5.3, Open Source 2.4.6 through 2.4.9.

This is a customer-plane takeover, not an admin compromise, which widens exposure from stores with sloppy backoffice hygiene to every storefront that offers login, and the payout is the victim's address book, order history and saved payment identifiers, good for card testing, loyalty point drains and credential-reuse follow-on at other sites. Two facts define the risk window: exploit attempts began within hours of the patch release, and Commerce merchants patch slowly, with only 38 percent of stores fixed six weeks after the 2025 SessionReaper emergency release, so a multi-week stretch of working attacks against unpatched stores is the base case rather than the tail risk. The rest of the batch raises the ceiling: CVE-2026-48413 is stored XSS scored 8.7 reachable by any logged-in customer, CVE-2026-48414 (7.7) reaches arbitrary code execution, and Adobe itself warned that Commerce is a repeat target. A store treating this as routine patch-cycle noise is misreading the signal; same-day exploit traffic against a no-authentication 9.1 is the pattern that preceded mass exploitation in every recent Commerce incident.

Move each store to the 2026-aug release for its line, or apply the isolated patch matching your -p level, for example 2-4-9-aug-2026.zip or 2-4-6-p15-aug-2026.zip, after the July 2026 isolated patch and in cumulative order; Cloud merchants can take the fix through cloud-patches instead of the ZIP files. Verify with the Commerce Version Tool, php vendor/bin/patch-status, and confirm the per-CVE vulnerability_status reads PROTECTED for CVE-2026-71362 before declaring the work done. Because the bug lives in session identity handling, invalidate all customer sessions after patching, then hunt your own records for its signature: sessions touching a customer id inconsistent with the logged-in identity, address or profile changes the real owner disclaims, and WAF blocks tagged for this CVE if you run Shield. CISA added CVE-2026-71362 to the KEV catalog on September 24, 2026 with a September 27 due date and mandatory forensic triage under BOD 26-04, so federal agencies past deadline owe triage of possible compromise, not just patching.

Watch for Sansec publishing store-scale counts, the form its CosmicSting and SessionReaper escalation posts took, as the marker that probes have turned into successful takeovers. Watch also for a published chain pairing CVE-2026-71362 with the stored XSS pair; session takeover plus low-privilege XSS would turn customer data theft into server-side code execution and move this into a different incident class.