CVE-2026-71362 Exploited: Adobe Commerce Account Takeover, Details and PoC are Public

TL;DR

Attackers began targeting an Adobe Commerce vulnerability, CVE-2026-71362, within hours of its disclosure. The flaw scores a CVSS of 9.1 and allows unauthenticated customer account takeover. Both the root-cause details and proof-of-concept exploit path are now public.

Why it matters

Magento and Adobe Commerce power a large share of online stores. This Adobe Commerce vulnerability lets an attacker hijack any shopper’s account. From there, they can read personal data, order history, addresses, and stored payment tokens.

The urgency is real. Sansec reports it blocked live exploitation attempts soon after Adobe’s advisory. Security firms confirm attacks started almost immediately after public disclosure.

How the attack works

The bug sits in how Magento handles customer identity in a session. An attacker first submits a failed account edit that stores their raw input. That stored data later gets copied back without filtering. Crucially, an attacker-supplied id value overwrites the session’s real customer id.

The session check only confirms the customer exists. It never verifies ownership, a password, or a token. So the attacker’s session simply becomes the victim’s. Sansec’s analysis of APSB26-92 details the identity switch, while an independent root-cause writeup maps the flow. This report omits the working steps.

Why it counts as unauthenticated

Self-registration is open by default on most stores. An attacker creates a throwaway account, a guest-allowed action. No victim credentials or interaction are needed. That combination earns the unauthenticated rating.

Affected versions

The flaw affects Adobe Commerce, Commerce B2B, and Magento Open Source. All release lines through the July 2026 patches are vulnerable.

Patch and mitigation steps

Apply the APSB26-92 isolated patch as soon as possible. First confirm you run the latest -p release for your branch. Then install the matching patch file. Because this Adobe Commerce vulnerability faces active exploitation, treat patching as urgent. A web application firewall rule that blocks a mass-assigned id on the customer edit and create endpoints adds a useful layer.

Support Our Threat Intelligence

Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.