Hackers Target Critical Adobe Commerce Flaw to Hijack Shopper Accounts

Researchers have observed attempts to exploit the critical vulnerability CVE-2026-71362 in the Adobe Commerce and Magento e-commerce platforms. The flaw lets attackers hijack shopper accounts and gain access to their personal data.

Adobe classifies the issue as an authorization error: an improper permissions check can grant “elevated access to sensitive resources” without authentication. The vulnerability is one of seven issues the company patched in its latest security update.

In the wild, despite the vendor's assurances

In its bulletin, Adobe states that it has no evidence of any of the patched vulnerabilities being exploited. However, Sansec, a company specializing in e-commerce security, reports that its Shield WAF application firewall is already blocking attempts to exploit CVE-2026-71362.

According to Sansec, the attack requires no existing account, no administrator privileges, and no action on the victim's part. After analyzing Adobe's patch, the researchers determined that Magento mishandles shopper identification within a session. This allows an attacker to switch their session to someone else's account and gain access to it along with the owner's private data.

Six more vulnerabilities

Beyond the main flaw, the August update fixes six other issues. Four of them are rated high severity:

• CVE-2026-48413 (8.7) and CVE-2026-48414 (7.7) — stored XSS vulnerabilities that can lead to arbitrary code execution; exploitation requires authentication.
• CVE-2026-48415 (7.6) — an authorization error in Adobe Commerce B2B that allows security mechanisms to be bypassed.
• CVE-2026-48416 (7.5) — a security bypass that requires neither authentication nor administrator privileges.

The remaining two issues — CVE-2026-48411 (medium, 6.5) and CVE-2026-48412 (low, 2.7) — involve improper authorization and privilege escalation and require administrator rights to exploit.

What administrators should do

Adobe recommends installing the August update as soon as possible for the supported Commerce, Commerce B2B, and Magento product lines. That said, Sansec points out a caveat: the monthly fixes are distributed not as a new release or updated Composer packages, but as standalone patch files. Before applying a patch, an administrator must make sure the latest -p version of the relevant supported branch is installed.

Source: Bleeping Computer