Critical Security Vulnerability Discovered in Adobe Commerce
Hackers have started exploiting a critical flaw that allows takeover of customer accounts.
1Critical Vulnerability Discovered
A critical security vulnerability with a CVSS score of 9.1 was identified in Adobe Commerce. Designated as CVE-2026-71362, this flaw allows unauthenticated attackers to hijack customer accounts. Exploitation attempts began shortly after Adobe published its security advisory. Cybersecurity firm Sansec blocked the initial attack attempts.
2Affected Systems
The vulnerability impacts all versions of Adobe Commerce, Commerce B2B, and Magento Open Source up to the July 2026 patches. Adobe released isolated patch files and urged users to update immediately. Patch APSB26-92 fixes this vulnerability along with six other security issues. Sansec Shield has already started blocking exploitation attempts.
3Technical Details of the Flaw
According to Sansec's analysis, this vulnerability enables attackers to switch a customer session to another customer account. This provides access to the victim's account and private customer data. Exploitation requires no existing account, administrator privileges, or user interaction, making it particularly dangerous.
4Adobe's Mitigation Measures
Adobe fixed the vulnerability by correcting how Magento handles customer identity in account sessions. The patch ensures more secure management of customer sessions. It also addresses other security issues including stored cross-site scripting (XSS) and authorization problems. Adobe strongly recommends immediate patch application.
5Sansec's Warnings
Sansec noted that exploitation began almost immediately after public disclosure. The company warned that attackers could use this flaw to cause large-scale data breaches. Sansec Shield can block attacks exploiting this vulnerability in real-time. The firm advises all Adobe Commerce users to implement additional security measures.
6Industry Impact
Adobe Commerce powers thousands of e-commerce sites worldwide, making this vulnerability particularly concerning. Security experts warn that sites storing financial information could be primary targets. Similar vulnerabilities have caused major data breaches in the past, highlighting the potential severity of this issue.
7Recommended User Actions
Adobe Commerce users must apply the APSB26-92 patch immediately. System administrators should review session management and customer data access controls. Sansec recommends using security solutions like Sansec Shield for additional protection. Users should also monitor and report any suspicious account activities.
8Long-term Implications
This incident demonstrates how quickly vulnerabilities in popular e-commerce platforms can be exploited. Cybersecurity experts emphasize the need for faster security advisories from software vendors and immediate patch application by users. Proactive security measures must be enhanced to prevent similar vulnerabilities in the future.
Original article: Security Affairs — Adobe Commerce'da Kritik Güvenlik Açığı Tespit Edildi