Active Exploitation Underway
Threat actors have begun actively exploiting a critical vulnerability in Adobe Commerce and Magento, Adobe's e-commerce platform powering millions of online storefronts. The flaw, tracked as CVE-2026-71362, is being leveraged to hijack customer accounts — putting consumer payment data, personal information, and order history at risk.
Attempts to exploit this vulnerability were first observed by researchers and reported by BleepingComputer, who noted that attacks are already occurring in the wild despite the relatively recent disclosure window.
About the Vulnerability
CVE-2026-71362 is a critical flaw in Adobe Commerce (formerly Magento Commerce) and Magento Open Source, Adobe's widely deployed e-commerce platform. While full technical details of the vulnerability class have not been formally confirmed in public disclosures, the exploitation pattern points to an authentication or session management weakness that permits attackers to assume control of arbitrary customer accounts without requiring the customer's credentials.
E-commerce platforms are high-value targets for this type of vulnerability: a compromised customer account can expose:
- Stored payment methods and billing addresses
- Order history and personal data
- Saved cart contents and loyalty program balances
- In some configurations, the ability to place orders at the victim's expense
Why Adobe Commerce Is a Prime Target
Adobe Commerce and Magento collectively power a significant share of global e-commerce infrastructure, from small boutique stores to enterprise-grade retail operations. This breadth of deployment makes the platform a persistent target for financially motivated threat actors, including:
- Magecart groups — known for injecting payment card skimmers into checkout pages
- Credential stuffing operators — who profit from reselling compromised account access
- Ransomware affiliates — who use e-commerce admin panel access as initial footholds
The combination of a critical CVSS rating and active exploitation means store operators face a narrow window to patch before broad exploitation campaigns take hold.
Recommended Actions for Merchants
Adobe has released patches addressing CVE-2026-71362. Store operators should take the following steps immediately:
1. Apply the Security Patch
Update Adobe Commerce or Magento Open Source to the patched version. Check the Adobe Security Bulletin for the specific patched release applicable to your version line.
2. Force Customer Password Resets
If you cannot confirm whether your store has been exploited, consider proactively invalidating all active customer sessions and prompting password resets as a precautionary measure.
3. Review Admin Logs
Check the Adobe Commerce admin activity logs for unexpected account modifications, suspicious login patterns, or unfamiliar admin user creation events.
4. Enable a Web Application Firewall
A WAF with Magento-specific rulesets (offered by Cloudflare, Sucuri, and others) can provide virtual patching as a temporary mitigation layer while permanent patches are applied.
5. Monitor for Indicators of Account Compromise
Alert on unusual account activity patterns — multiple accounts accessed from the same IP, accounts placing orders immediately after login, or profile changes shortly after authentication.
Broader Context: E-Commerce Under Siege
This disclosure follows a pattern of sustained attacker interest in e-commerce platforms. The Magento/Adobe Commerce ecosystem has been a recurring target for skimming campaigns, admin panel brute force attacks, and plugin-chain vulnerabilities.
Merchants — especially those running self-hosted Magento Open Source deployments — often lag on patch cadence due to the complexity of upgrade paths and the risk of breaking customizations. Attackers exploit this delay window aggressively once a working exploit technique becomes available.