Critical Adobe Commerce Flaw Exploited Immediately After Disclosure, Warns Sansec
A highly critical security vulnerability in Adobe Commerce has been targeted by hackers mere hours after its public disclosure, according to webstore security firm Sansec. The bug, tracked as CVE-2026-71362 with a CVSS score of 9.1, allows unauthenticated attackers to elevate their privileges and take over other customer accounts.
The flaw was identified in all versions of Commerce, Commerce B2B, and Magento Open Source up to and including those running the July 2026 patches. Sansec reports that it started blocking exploitation attempts soon after Adobe published its advisory on August 2026 Patch Tuesday. The security firm warns that threat actors have a history of targeting Commerce before, making this vulnerability particularly concerning.
Sansec reviewed the patch released by Adobe and confirmed that the flaw lets attackers switch a customer session to another customer account. This gives them access to the victim’s account and private customer data. To exploit the bug, hackers need only be remote and unauthenticated, making it a highly accessible entry point for malicious actors.
Adobe resolved the underlying issue by modifying how Commerce and Magento handle customer identity in account sessions. The company also rolled out an isolated patch to fix the critical flaw and six other security defects in all three products. In its advisory, Adobe urged merchants to apply the latest security updates as soon as possible, warning that successful exploitation could lead to arbitrary code execution, security feature bypass, and privilege escalation.
The rapid exploitation of this vulnerability serves as a stark reminder of the importance of timely patching and vigilance in the face of disclosed security flaws. As Sansec notes, “Please apply the latest security updates as soon as possible.” Merchants and administrators are advised to prioritize patching their Adobe Commerce instances to prevent potential breaches.
In light of this incident, it’s essential for organizations using Adobe Commerce to regularly review and update their security protocols. This includes implementing a robust patch management strategy, conducting regular vulnerability scans, and educating staff on the importance of timely patching and security best practices. By taking these steps, businesses can mitigate the risk of falling victim to exploitation attempts like this one.
Source: SecurityWeek — 2026-08-13