CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability

Overview

CISA added CVE-2026-71362 to its Known Exploited Vulnerabilities (KEV) catalog on September 24, 2026, confirming active in-the-wild exploitation of a critical incorrect authorization flaw in Adobe Commerce and Magento Open Source. Per the CISA KEV description, the bug "could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction."

The vulnerability was originally disclosed by Adobe on August 11, 2026 in security bulletin APSB26-92, which patched seven flaws in Commerce and Magento — CVE-2026-71362 was the headline issue, rated Critical with a CVSS v3.1 base score of 9.1. According to e-commerce security firm Sansec, which analyzed the patch, the root cause is improper binding of customer identity to an account session: an attacker can rebind their own authenticated session to an arbitrary victim's customer account, gaining access to that account and its stored personal data — with no privileges, no prior account, and no user interaction required.

Sansec reported blocking the first exploitation attempts within days of Adobe's disclosure. CISA's KEV listing on September 24 formalizes that this flaw is now being actively exploited, and per Binding Operational Directive guidance, federal agencies are expected to prioritize rapid remediation of publicly exposed, internet-facing Commerce and Magento instances.

Technical Details

How It Works

Adobe Commerce and Magento bind a shopper's browser session to a specific customer identity after login. Sansec's analysis of the APSB26-92 patch found that this binding could be manipulated: the platform failed to correctly re-validate customer identity when a session was rebound mid-flow, letting an attacker's session assume the identity of a different, arbitrary customer account.

A researcher-published proof-of-concept illustrates the mechanics:

1. Register an attacker account on the target storefront — no special access needed.
2. Poison the session by issuing a deliberately failing editPost request that carries a mass-assigned id parameter pointing at a victim's customer record.
3. Trigger the vulnerable edit endpoint, which rebinds the attacker's active session to the targeted customer ID instead of rejecting the malformed request.
4. Enumerate victim accounts by iterating customer IDs, harvesting names, addresses, order history, and other stored PII from each hijacked session.

Because the flaw requires only network access to the public storefront — which is exposed by design — and no credentials, prior account trust, or user interaction, it is trivially scriptable and scales to mass enumeration of a store's customer base.

Impact Assessment

Mitigation

For Merchants Running Adobe Commerce or Magento

• Patch immediately. Adobe's fixed builds are 2.4.9-2026-aug down through 2.4.4-2026-aug for Commerce and Magento Open Source, and 1.5.3-2026-aug through 1.3.3-2026-aug for Commerce B2B, as published in APSB26-92. Given confirmed active exploitation, treat this as an emergency change, not a routine patch cycle.
• Assume compromise if unpatched and internet-facing. Given exploitation began within days of disclosure in August and CISA confirmed ongoing exploitation as of September 24, any unpatched public storefront should be treated as potentially already exploited.
• Force session invalidation for all active customer sessions after patching, to eliminate any sessions that may already be rebound to a victim identity.
• Review order and account-edit logs for suspicious mass-assignment patterns, particularly editPost-style requests carrying unexpected id parameters.

For Security Teams

• Prioritize KEV-listed CVEs. CISA's Binding Operational Directive guidance calls for rapid remediation of internet-exposed assets affected by catalog entries; the federal deadline associated with this listing falls within days of the September 24 addition.
• Audit customer-facing session management more broadly — session/identity rebinding classes of bugs (CWE-863) often recur across releases once a first instance is found.
• Monitor for PoC-driven scanning. Public proof-of-concept code and at least one Nuclei detection template are available, which typically accelerates opportunistic mass scanning against unpatched instances.

For Downstream Businesses / Customers

• Rotate passwords on affected storefronts as a precaution if your merchant has confirmed exposure, particularly if stored payment or address data may have been viewed.
• Watch for unexpected account activity — unfamiliar orders, address changes, or login notifications on Commerce/Magento storefronts you use.

Detection Opportunities

• Anomalous editPost or account-edit requests carrying an id parameter that does not match the requesting session's authenticated customer.
• Rapid, sequential customer-ID enumeration patterns against account or order-history endpoints from a single source IP or session.
• Session-identity mismatches in application logs — a session cookie associated with one customer ID suddenly serving data for another.
• Spikes in failed or malformed editPost-style requests immediately preceding a successful account-data access — consistent with the published PoC's "poison, then trigger" pattern.

Key Takeaways

1. CVE-2026-71362 is a critical (CVSS 9.1), pre-authentication account-takeover flaw in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source, caused by incorrect binding of customer identity to session state.
2. No credentials, privileges, or user interaction are required — an attacker only needs network access to a store's public-facing storefront.
3. Active exploitation is confirmed. Sansec observed exploitation attempts within days of Adobe's August 11, 2026 disclosure, and CISA added the CVE to its KEV catalog on September 24, 2026 based on evidence of ongoing in-the-wild attacks.
4. Patches have been available since August 11, 2026 via Adobe bulletin APSB26-92 — unpatched, internet-facing instances should be treated as a high-urgency remediation priority.
5. Public PoC code and detection tooling exist, which typically accelerates opportunistic mass scanning against remaining unpatched stores.
6. Merchants should force session invalidation and audit logs for mass-assignment abuse after patching, since sessions active before the fix may already have been rebound to a victim identity.

References

• NVD — CVE-2026-71362
• CISA — Known Exploited Vulnerabilities Catalog
• SecurityWeek — Adobe Commerce Bug Targeted Immediately After Disclosure
• SecurityAffairs — Adobe Commerce CVE-2026-71362 Comes Under Attack Shortly After Public Disclosure