Cybersecurity experts have sounded the alarm over a zero-day vulnerability affecting Magento and Adobe Commerce, two popular e-commerce platforms used by thousands of online stores worldwide. The unpatched flaw has already been exploited in the wild, allowing attackers to gain unauthorized access and plant malicious code on affected sites.
The issue revolves around a privilege escalation vulnerability that allows hackers to elevate their privileges from guest or customer accounts to administrator-level access. This means an attacker can essentially take control of an online store’s backend, making it easier to inject malware, steal sensitive data, or even hold the site for ransom. What makes this attack particularly concerning is its potential to spread across multiple sites, as some e-commerce platforms share common code and dependencies.
Magento and Adobe Commerce are among the most widely used e-commerce solutions on the web, with a combined user base of over 250,000 online stores worldwide. Many of these businesses rely heavily on their e-commerce platform for sales, customer interaction, and data management. With the zero-day vulnerability now being exploited in the wild, it’s only a matter of time before more sites are compromised unless urgent action is taken.
The attack vector appears to involve exploiting cross-domain privilege escalation (CDEP) vulnerabilities that allow an attacker to traverse security boundaries between different domains or applications on the same server. This can lead to unpatched dependencies and libraries being exposed, providing an entry point for malicious actors. The fact that this vulnerability has already been used in real-world attacks raises concerns about potential data breaches and disruptions to online businesses.
While the exact number of affected sites is still unknown, cybersecurity experts warn that any e-commerce platform relying on Magento or Adobe Commerce should take immediate action to secure their site. This includes verifying for any known vulnerabilities, updating dependencies and libraries, and implementing robust security measures such as network segmentation, access controls, and regular backups. In light of this incident, businesses are reminded to prioritize ongoing vulnerability management, staying up-to-date with the latest patches and security best practices.
As online stores struggle to stay ahead of evolving cyber threats, it’s essential for business owners and administrators to recognize the importance of proactive cybersecurity measures. Regular monitoring, swift patching, and robust security controls can help mitigate potential breaches and protect sensitive customer data. By taking these steps proactively, e-commerce businesses can minimize their risk exposure and ensure continued trust with their customers.
Source: The Hacker News — 2026-09-05