Adobe patched a critical Commerce and Magento flaw on August 11 that let unauthenticated attackers hijack customer accounts outright, and exploitation attempts began almost immediately after the fix shipped. CVE-2026-71362, disclosed in Adobe security bulletin APSB26-92, is an incorrect authorization issue (CVSS 9.1) caused by Adobe Commerce and Magento Open Source failing to correctly bind a customer’s identity to their account session. An attacker needs no existing account, no administrator privileges, and no user interaction to switch into another shopper’s session and pull private data. The flaw affects Adobe Commerce release lines 2.4.4 through 2.4.9 and Magento Open Source 2.4.6 through 2.4.9 at their July 2026 builds; Adobe’s fixed August 2026 builds close it. Adobe said it had no evidence of in-the-wild exploitation at disclosure, but ecommerce security firm Sansec reported its web application firewall was already blocking exploitation attempts against the flaw shortly after the patch went public.
The gap between “patched” and “actively targeted” here was measured in hours, and that is the real story: attackers now treat a vendor’s own release notes as a working target list, reverse-engineering the fix to build an exploit before most storefronts have applied it. Session-identity binding flaws like this one also tend to be under-triaged internally, filed as access-control or business-logic bugs rather than the CVSS 9.1 authorization failure they actually are, which slows how fast a retail security team escalates the patch.
This is the second Adobe product line CyberTech has covered with a maximum-severity authorization gap this year, after a critical Campaign Classic flaw forced an emergency fix in Adobe’s marketing stack. Retailers running Adobe Commerce or Magento should apply the August builds immediately and audit session logs for anomalous account-switching patterns, the same triage urgency CyberTech flagged when a cPanel privilege escalation bug let any hosting user run SQL as root.
