Loading story…
Attackers have begun targeting CVE-2026-71362, a critical incorrect-authorization flaw in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source that can let unauthenticated users hijack customer accounts. Sansec reported seeing exploitation attempts blocked by its Shield WAF and said patch analysis showed Magento mishandles customer identity within an account session, allowing a session to be switched to another customer account and exposing private customer data.
Adobe included fixes for CVE-2026-71362 in its August 2026 security updates, with affected versions spanning multiple July 2026 and some August 2026 release lines before newer August builds. The same update also addressed CVE-2026-48413, a stored XSS issue, along with six additional Commerce and Commerce B2B vulnerabilities, four rated high severity. Administrators were urged to move to the latest supported -p release and apply Adobe’s isolated patches promptly to reduce the risk of account takeover and data exposure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
In its advisory for the August 2026 fixes, Adobe stated it was not aware of exploits in the wild for any of the patched vulnerabilities. This included the critical incorrect-authorization flaw CVE-2026-71362.
Adobe addressed seven vulnerabilities in an August 2026 security update for Adobe Commerce, Adobe Commerce B2B, and Magento Open Source, including CVE-2026-71362 and CVE-2026-48413. The fixed version boundaries indicate August 2026 builds as unaffected across the supported product branches.
After analyzing Adobe's patch, Sansec said Magento improperly handles customer identity in an account session, allowing attackers to switch a session to another customer's account. Successful exploitation could expose private customer data and enable customer account hijacking.
Sansec reported that its Shield web application firewall was already blocking attempts to exploit CVE-2026-71362. The company said the flaw can be targeted without an existing account, administrator privileges, or user interaction.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcecyberaccord.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcesansec.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe released an out-of-band fix for **CVE-2025-54236**, a critical improper input validation flaw in **Adobe Commerce**, **Adobe Commerce B2B**, and **Magento Open Source** that allows unauthenticated attackers to take over user sessions through vulnerable session-handling and Web API components. The bug, dubbed **"SessionReaper"** by Sansec, carries a reported **CVSS 9.1** rating and can lead to account hijacking, exposure of customer data, fraudulent orders, administrative access, and in some scenarios potentially remote code execution. Affected releases span multiple 2.4.x branches, including versions from **2.4.4 through 2.4.7** and other listed builds and earlier releases. Security guidance escalated after reports said the flaw was being actively exploited in the wild and added to **CISA's Known Exploited Vulnerabilities** catalog. Adobe published remediation details in **APSB25-88** and shipped patched versions, while defenders were urged to apply the vendor fix immediately, verify patch status, review logs for anomalous session activity, tighten administrative access, and increase **WAF**, API, and **SIEM** monitoring. Advisories also warned that leaked hotfix details and unofficial fixes could accelerate attacker weaponization or create additional risk.
Jun 29, 2026
Adobe released a broad set of security advisories covering creative, enterprise, and e-commerce products, and the Canadian Centre for Cyber Security urged organizations to review and apply the updates. Affected software includes **ColdFusion**, **Adobe Experience Manager (AEM)**, **Adobe Commerce**, **Magento Open Source**, **Animate**, **After Effects**, **Audition**, **Bridge**, **Media Encoder**, **Premiere**, **Premiere Pro**, **Illustrator**, **Creative Cloud Desktop Application**, and Content Credentials tools and SDKs. Among the disclosed issues, **ColdFusion** flaws `CVE-2026-48363` and `CVE-2026-48364` are uncontrolled search path vulnerabilities that can lead to arbitrary code execution when a user opens a malicious file; **Animate** bugs `CVE-2026-48345` and `CVE-2026-48350` can also enable code execution via malicious files through OS command injection and path traversal; and **AEM** vulnerabilities `CVE-2026-48310` and `CVE-2026-48252` are more severe for internet-facing deployments because they require no user interaction and can allow arbitrary file reads, unauthorized write access, and security feature bypass. Adobe also issued fixes for multiple **Adobe Commerce**, **Adobe Commerce B2B**, **Magento Open Source**, and **Adobe Commerce Webhooks Plugin** vulnerabilities, including stored XSS, incorrect authorization, improper output encoding, and unrestricted file upload issues, with patched July 2026 releases and Webhooks Plugin version `1.21.0` identified as remediated versions.
Jul 23, 2026
**Adobe Commerce** disclosed multiple **stored cross-site scripting (XSS)** vulnerabilities affecting versions `2.4.9-alpha3`, `2.4.8-p3`, `2.4.7-p8`, `2.4.6-p13`, `2.4.5-p15`, `2.4.4-p16`, and earlier. The issues tracked as `CVE-2026-21284`, `CVE-2026-21290`, `CVE-2026-21311`, and `CVE-2026-21361` allow malicious JavaScript to be injected into vulnerable form fields and later executed in a victim’s browser when the affected page is viewed. Adobe indicates the impact can include **session takeover** and high confidentiality and integrity risk. The vulnerabilities differ primarily in the privilege level required to plant the payload, with most requiring a **high-privileged attacker** and at least one (`CVE-2026-21290`) being exploitable by a **low-privileged attacker**. In all cases, exploitation requires **user interaction**, as a victim must browse to the page containing the injected content. A separate write-up about a chained exploit involving `postMessage` misconfiguration, prompt injection, and sandbox escape on an AI assistant platform does not describe the same Adobe Commerce disclosure and should be excluded.
Jun 29, 2026