Critical Adobe Commerce Flaw Under Active Exploit Lets Attackers Hijack Customer Sessions

Hackers are actively exploiting a critical security flaw in Adobe Commerce and Magento, two widely used platforms for building online stores. The vulnerability, tracked as CVE-2026-71362, allows attackers to hijack customer accounts without needing any credentials or user interaction. Adobe released a security update on August 11, 2026, addressing this and six other issues. Although Adobe stated at the time of the advisory that it was not aware of any exploits in the wild, security firm Sansec reported that its Shield web application firewall has already blocked attempts to exploit this flaw.

According to Sansec, exploiting CVE-2026-71362 requires "no existing account, administrator privileges or user interaction." That means a remote attacker can simply target a vulnerable store and take over a customer's session. After analyzing Adobe's patch, Sansec researchers found that the problem lies in how Magento handles customer identity in an account session. Specifically, the vulnerability lets an attacker switch a customer session to another customer account, giving them access to the victim's account and private data such as order history, addresses, and possibly payment details. This type of flaw is known as an incorrect authorization vulnerability, meaning the system does not properly verify whether a user has permission to access certain resources.

The August 2026 security update from Adobe fixes seven vulnerabilities in total. Besides CVE-2026-71362, four other flaws received a high severity score. CVE-2026-48414 is a stored cross-site scripting vulnerability with a score of 7.7; exploitation requires authentication and administrator privileges. CVE-2026-48413 is also a stored cross-site scripting flaw, but it has a higher score of 8.7 and only requires authentication, not administrator access. CVE-2026-48415 is an incorrect authorization issue affecting Adobe Commerce B2B with a score of 7.6, requiring authentication but not admin privileges. CVE-2026-48416 is another incorrect authorization flaw with a score of 7.5 that requires neither authentication nor administrator privileges. The remaining two issues are medium and low severity: CVE-2026-48411 (6.5) requires authentication and admin rights, and CVE-2026-48412 (2.7) also requires authentication and admin rights for privilege escalation. All of these should be patched as soon as possible, but the actively exploited CVE-2026-71362 is the most urgent because it has the lowest barrier to attack.

Website administrators running Adobe Commerce, Commerce B2B, or Magento should apply the August 2026 security update immediately. According to Sansec, Adobe distributes these monthly fixes as isolated patch files rather than a full new release or updated Composer packages. This means site owners must first confirm they are running the latest -p release available for their supported branch, and then apply the corresponding isolated patch. Failing to do this correctly could leave the store vulnerable. For many small and medium businesses, managing these patches can be challenging, especially if they do not have dedicated IT staff. A managed hosting provider like AEU Hosting can help by keeping the underlying platform updated and adding security layers, which reduces the risk of such exploits succeeding.

The stakes are high for online retailers. Once an attacker hijacks a customer account, they can view personal information, place fraudulent orders, or even change the account password to lock out the legitimate owner. Sansec also notes that overall prevention scores can be misleading: once attackers have valid credentials, only 37% of their actions are blocked. This means the best defense is to prevent initial access by patching vulnerabilities before they are exploited. For any website owner, this incident is a reminder that security updates are not optional. If you run an e-commerce site, check with your developer or hosting provider today to make sure the August 2026 update has been applied.