Adobe patches a Magento flaw that hands over customer accounts

Aug 13, 2026 4 min read Daniel A. & Óscar S.

Adobe has shipped a fix for CVE-2026-71362, a flaw in Adobe Commerce and Magento that lets an attacker take over a customer account without holding an account, without admin rights and without the victim clicking anything. It carries a CVSS score of 9.1, and the patch went out in the August 2026 security update, advisory APSB26-92.

Context

The bug is in how Magento handles customer identity inside a session. An attacker can get their session switched to somebody else's account, at which point the store treats them as that customer. There is no password to guess and no link to send: the shop hands over the session on request.

The affected range is 2.4.4 through 2.4.9 on the July 2026 builds and earlier, across Commerce, Commerce B2B and Magento Open Source. That is most of the installed base, because Magento shops are famously slow to update: the platform is heavily customised, upgrades break themes and extensions, and the person who built the shop is often long gone.

Why it matters

Unauthenticated matters more than the CVSS number does. Plenty of critical flaws need a foothold first, some credentials, or a user to be talked into clicking. This one needs a network connection and the address of a shop that has not patched.

What an attacker walks away with is a customer profile: order history, delivery address, phone number, email. That is not a card dump, and it is arguably more useful for what usually comes next. Someone who can tell you what you ordered last week and where it was sent sounds exactly like the shop when they call about a "problem with your delivery". This is the raw material of the delivery scam that follows.

The bigger picture

There is a disagreement here worth stating precisely rather than flattening. Adobe's advisory says it is not aware of exploitation in the wild. Sansec, an e-commerce security firm, says its Shield web application firewall is already blocking attempts against this CVE. Both can be true at once: blocked attempts prove somebody is probing, not that anybody has succeeded.

For a shop owner the distinction changes nothing about what to do and quite a lot about when. Attempts being blocked at one vendor's WAF means the technique is circulating, and the gap between a Magento advisory and mass scanning has historically been measured in days.

Are you affected

If you run a store: yes, if it is Commerce, Commerce B2B or Magento Open Source on 2.4.4 to 2.4.9 without the August 2026 update. Check the version rather than assuming, and check it on the live install rather than on what the last deploy was supposed to contain.

If you shop online: possibly, and you have no way of knowing. Nothing on your device is vulnerable and no password of yours is at fault. Whether you are exposed depends entirely on whether a shop you have an account with has patched.

What to do now

Running a store, in this order: apply the August 2026 update for your release line; invalidate existing customer sessions so anything already established stops working; then read back through login and order records for access that does not fit the customer's usual pattern. Patching alone leaves a session that was already taken in place.

Shopping on stores, the boring advice that keeps paying off: a unique password per shop, so one store's flaw stays inside that store, which is the entire argument for a password manager. And no saved card on a site you use twice a year. If a shop you use writes to you about an order in the next few weeks, treat an unexpected link the way you would any other, and go to the site yourself instead.

Source: Adobe security bulletin APSB26-92 →

Frequently asked questions

Is CVE-2026-71362 being exploited in the wild?

That depends on who you ask, and the difference is worth keeping straight. Adobe's own advisory says it is not aware of exploits in the wild. Sansec, an e-commerce security vendor, says its Shield web application firewall is already blocking exploitation attempts against the flaw. Blocked attempts are not the same as confirmed compromises, but they do mean somebody is trying, which is reason enough to patch now rather than at the end of the month.

I shop on small online stores. Am I at risk?

Only on stores that run Adobe Commerce or Magento and have not applied the August 2026 update, and you have no way to tell which those are from the outside. There is nothing to fix on your side, because the flaw is in the store's software rather than in your device or password. The sensible precautions are the ordinary ones: a unique password per store so one shop's problem stays there, and no card saved on a site you use twice a year.

What would an attacker actually get?

The contents of a customer account: order history, delivery addresses, phone number, email, and whatever else the shop stores in the profile. That is a good starting point for a convincing scam, because someone who can quote your last order and your address sounds like the shop when they call or write. Full card numbers are normally held by the payment processor rather than the store, so those are usually out of reach.

I run a Magento store. What is the fix?

Apply the August 2026 security update for your release line, which covers Commerce, Commerce B2B and Magento Open Source. The affected versions are 2.4.4 through 2.4.9 on the July 2026 builds and earlier. After patching, invalidate customer sessions so anything already established stops working, and check order and login logs for account access that does not match the customer's usual pattern.

Who writes this

Daniel A. and Óscar S. run Breachfolio, a small independent site about security and AI. This article was drafted with AI assistance and reviewed by a person before it went live. We write from documentation, vendor sources and published research rather than from original lab benchmarks, and we link a source in the sentence that relies on it. How we work · About us

← Back to News