Adobe Commerce Security Exploit Patched Immediately After Disclosure

Post Views: 5

Adobe Commerce Vulnerability Exploited Shortly After Public Disclosure Cybercriminals began exploiting a newly disclosed critical vulnerability in Adobe Commerce shortly after its public release, according to security firm Sansec.

Security Firm Sansec Reports Exploitation

The flaw, designated CVE-2026-71362 with a CVSS score of 9.1, is classified as an authorization misconfiguration that enables unauthenticated attackers to escalate privileges. Adobe addressed the issue during its August 2026 Patch Tuesday update, stating no evidence of active exploitation in the wild but acknowledging prior targeting of Commerce by threat actors.

Sansec confirmed that the vulnerability was actively targeted within hours of the advisory’s publication.

Vulnerability Details and Impact

The flaw allows remote, unauthenticated adversaries to hijack customer sessions and access sensitive account data. The firm’s analysis revealed that the patch resolved the issue by modifying how Adobe Commerce and Magento handle customer identity validation during sessions.

Attackers could exploit the flaw to impersonate users, granting access to private information and potentially compromising merchant systems. The vulnerability affects all Adobe Commerce, Commerce B2B, and Magento Open Source versions up to and including those utilizing the July 2026 patches.

Patch and Adobe’s Response

Adobe issued an isolated patch to address the critical flaw alongside six other security issues across its product lineup. The company emphasized that the update allows merchants to apply fixes independently, reducing risks associated with integration challenges.

Adobe’s advisory highlighted the potential consequences of unpatched systems, including arbitrary code execution, security feature bypasses, and privilege escalation. The firm urged immediate implementation of the latest security updates to mitigate risks.

Urgency of Patch Management

The flaw underscores the urgency of timely patch management, as threat actors often exploit newly disclosed vulnerabilities within hours of their release. Organizations using affected versions are advised to apply the patch promptly and monitor for signs of unauthorized access.

Frequently Asked Questions

What is the severity of the Adobe Commerce vulnerability?

The vulnerability, tracked as CVE-2026-71362, carries a CVSS score of 9.1, indicating a critical severity level. It allows unauthenticated attackers to escalate privileges and access sensitive customer data.

Which Adobe products are affected?

The flaw impacts Adobe Commerce, Commerce B2B, and Magento Open Source versions up to and including those running the July 2026 patches.

How did Adobe address the issue?

Adobe resolved the vulnerability by modifying session handling for customer identities in Commerce and Magento. An isolated patch was released to address the flaw and six additional security issues.

What steps should organizations take?

Merchants using affected versions are advised to apply the latest security updates immediately. Monitoring for unauthorized access and implementing strict patch management protocols are critical to mitigating risks.