CVE-2026-71362 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-08-11

Added to CISA KEV: 2026-09-24 44 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL — PATCH IMMEDIATELY: Apply Adobe Security Bulletin APSB26-92 patches released August 11, 2026. Upgrade to Adobe Commerce 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, or 2.4.4-2026-aug. For Magento Open Source, upgrade to 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, or 2.4.6-2026-aug. For B2B, upgrade to corresponding -2026-aug releases.
INCIDENT RESPONSE: Due to public PoC availability and unauthenticated exploitation, conduct immediate compromise assessment — review access logs for anomalous session behavior, unexpected account privilege changes, orders placed under unfamiliar sessions, or API calls with mismatched session/account identifiers.
LOG REVIEW: Audit customer account activity for the period between July 2026 patches and August 2026 patches. Flag any accounts with unusual login geography, order patterns, or account detail changes. Notify affected customers if unauthorized access is confirmed.
TEMPORARY MITIGATION (if patching is delayed): Consider implementing WAF rules to detect and block session manipulation patterns, rate-limit unauthenticated API endpoints, and enable enhanced session logging. Contact Adobe/Magento security for vendor-provided WAF signatures.
MONITORING: Deploy alerts for anomalous session switching behavior, privilege escalation events in application logs, and mass automated requests to authentication/session endpoints consistent with automated exploitation.
PATCH PRIORITY: CRITICAL — treat as P0/emergency patch. Public PoC availability combined with CISA's Automatable=YES rating means mass exploitation by opportunistic attackers is imminent if not already occurring. Do not wait for a scheduled maintenance window.
POST-PATCH: Reset all active customer sessions after patching to invalidate any sessions that may have been compromised. Consider forced password resets for high-value accounts (admin, B2B buyers with large credit limits).
THIRD-PARTY EXTENSIONS: If using third-party Magento extensions, verify they do not reintroduce the session management flaw or conflict with the August 2026 security patches.

🔍 Web Intelligence (Kagi · 2026-09-24)

Summary

CVE-2026-71362 is a critical-severity incorrect authorization vulnerability (CWE-863) affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source . The flaw stems from a failure in the platform's session management, which allows for a customer-session identity-switch. This vulnerability is significant because it enables unauthorized actors to perform account takeovers, posing a high risk to retailers handling sensitive customer data and large commerce assets .

Exploitation

Active Exploitation: There are reports of active interest and public proof-of-concept (PoC) availability .
PoC/Exploit Availability: Public, one-command Docker lab environments are available for researchers and defenders to reproduce the account-takeover primitive .
Attack Prerequisites: The vulnerability is characterized as an unauthenticated issue in some contexts, allowing for potential remote exploitation without needing legitimate user credentials or complex interaction, depending on the implementation .

Affected Products & Patches

Affected Products: Adobe Commerce, Adobe Commerce B2B, and Magento Open Source .
Patch Availability: Adobe released a security update via Security Bulletin APSB26-92 on August 11, 2026, to resolve this and other identified vulnerabilities .
Mitigation: Organizations are strongly advised to apply the patches provided in APSB26-92 immediately .

Impact

Successful Exploitation: Provides the capability for privilege escalation and unauthorized account takeovers, potentially granting attackers full access to victim customer accounts .
Business Risk: For internet-facing deployments, this vulnerability presents a critical business risk, including potential data breaches, financial fraud, unauthorized access to sensitive user information, and significant reputational damage if customer sessions are compromised en masse .