CVE-2026-71362: Adobe Commerce — Customer Account Hijack Risk (June 2024)

CVE-2026-71362 — Adobe Commerce

CVE-2026-71362 is a critical incorrect-authorization vulnerability in Adobe Commerce and Magento. It allows remote attackers to hijack customer sessions and access sensitive account data without authentication. While no confirmed in-the-wild exploitation has been reported, active exploitation attempts are being blocked by Sansec’s Shield WAF. Adobe has released security patches addressing this flaw and six others. Immediate remediation is required due to the risk of large-scale account compromise and data breaches.

Attack Vector

Attackers exploit CVE-2026-71362 by sending crafted requests to vulnerable Adobe Commerce or Magento endpoints, bypassing authentication controls. Successful exploitation grants unauthorized access to customer sessions and private data. No valid credentials or internal access are required; exploitation is possible remotely over the internet. Sansec’s Shield WAF has detected and blocked ongoing exploitation attempts, indicating that threat actors are actively probing for unpatched systems.

Who Is at Risk

All organizations running Adobe Commerce or Magento deployments are at risk, regardless of region or sector. Both cloud and on-premise installations are affected. No specific versions are excluded unless patched per Adobe’s latest security advisory. E-commerce platforms with public exposure are especially vulnerable to automated exploitation.

Patch & Mitigate

• Patch: Apply the latest Adobe Commerce and Magento security updates released June 2024. Refer to Adobe’s official advisory for exact version numbers and patch instructions. Patch immediately.
• Workaround: No reliable workaround is available. WAF rules (such as Sansec Shield) may provide temporary mitigation but do not replace patching.
• Detect: Monitor logs for unauthorized session access, anomalous API calls, and failed authentication attempts. Look for patterns matching known exploitation attempts as flagged by WAFs.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit public-facing applications to gain a foothold without credentials.
• TA0003 — Persistence: Hijacked sessions allow continued unauthorized access to customer accounts.

Source: https://www.hendryadrian.com/hackers-exploit-critical-adobe-commerce-flaw-to-hijack-customer-accounts/