CVE-2026-71362

This is a security mistake in Adobe Commerce that lets someone who is not logged in use the site in a way that bypasses permission checks. Security reporting indicates attackers can hijack customer sessions, which can expose private customer information, as if the attacker were the customer.

This matters if your business runs Adobe Commerce (including Adobe Commerce B2B) or magento open source. The risk is especially serious because the flaw can be triggered remotely without authentication and without user interaction—an attacker only needs network access to your Commerce site.

This is RED because exploitation has been reported in the wild and attackers can take over customer sessions without logging in. The fix is available in specific Adobe Commerce / Adobe Commerce B2B / magento open source versions, so delaying upgrades meaningfully increases the chance of real customer data impact.

1. Confirm exposure (start today)

• Identify which product you run: Adobe Commerce, Adobe Commerce B2B, or magento open source.
• Identify the exact installed version.
• If you are not on one of the fixed versions listed below, you should assume you are exposed.

2. Upgrade to the fixed version (target versions)

• Adobe Commerce: upgrade to 2.4.9-2026-aug (or 2.4.8-2026-aug / 2.4.7-2026-aug / 2.4.6-2026-aug / 2.4.5-2026-aug / 2.4.4-2026-aug).
• Adobe Commerce B2B: upgrade to 1.5.3-2026-aug (or 1.5.2-2026-aug / 1.4.2-2026-aug / 1.3.4-2026-aug / 1.3.3-2026-aug).
• magento open source: upgrade to 2.4.9-2026-aug (or 2.4.8-2026-aug / 2.4.7-2026-aug / 2.4.6-2026-aug).

3. Practical upgrade notes

• Follow your normal maintenance procedure (backup first, test in staging if you have one, then roll out during a low-traffic window).
• After upgrade, validate storefront/admin access and verify customer login flows.

4. If patching is delayed (temporary containment)

• Treat active exploitation as possible. Use any available web application firewall (WAF) protections that can block the exploitation attempts you’re seeing; reporting indicates WAFs have been blocking attempts shortly after the advisory.
• Tighten access to your Commerce application endpoints at the network layer where possible (for example, limiting exposure to only the necessary public entry points).

5. What to monitor after the upgrade

• Look for signs of account/session switching and abnormal customer behavior in your application and web server logs.
• If you detect suspicious activity, consider notifying affected customers and increasing account monitoring/reset steps per your incident process.

CVE-2026-71362 is a CWE-863 (Incorrect Authorization) vulnerability in Adobe Commerce and related distributions. Findings indicate it is remotely reachable and does not require authentication or user interaction, enabling an attacker to hijack customer sessions and gain elevated access to sensitive resources (privacy impact is high). Exploitation has been reported (first reported 2026-08-11), and a WAF reportedly started blocking exploitation attempts shortly after Adobe’s advisory, indicating active attacker interest. KEV listing is not present in CISA KEV, and no public exploit code has been recorded, but real-world exploitation has still been reported.