Hackers started targeting a fresh critical-severity Adobe Commerce vulnerability immediately after public disclosure, webstore security firm Sansec reports.
Tracked as CVE-2026-71362 (CVSS score of 9.1), the security defect is described as an incorrect authorization issue that allows unauthenticated attackers to elevate their privileges.
Adobe resolved the flaw on August 2026 Patch Tuesday, saying it had no evidence of in-the-wild exploitation, but warning that threat actors have targeted Commerce before.
Shortly after Adobe’s advisory was published, Sansec warned that it blocked the first exploitation attempts targeting the CVE.
According to Sansec, the flaw can be exploited by remote, unauthenticated attackers to take over other customer accounts.
“Sansec reviewed the patch and confirmed that the vulnerability lets attackers switch a customer session to another customer account. This gives them access to the victim’s account and private customer data,” the cybersecurity firm notes.
Adobe resolved the underlying issue by modifying how Commerce and Magento handle customer identity in account sessions, Sansec says.
The vulnerability impacts all Commerce, Commerce B2B, and Magento Open Source versions up to and including those running the July 2026 patches.
On Tuesday, Adobe rolled out an isolated patch to fix the critical flaw and six other security defects in all three products, and published installation instructions.
“Please apply the latest security updates as soon as possible. Successful exploitation of these vulnerabilities could lead to arbitrary code execution, security feature bypass, and privilege escalation,” the company notes.
“[The isolated patch] allows merchants to apply the fix in isolation with fewer risks of delay due to potential integration issues,” Adobe says.
Related: WordPress 7.0.4 Patches Remote Code Execution Vulnerability
Related: Nightmare Eclipse Drops Windows Zero-Day Exploit ‘ShieldBreak’
Related: Zoom Patches Zero-Click Code Execution Vulnerability
Related: SonicWall Patches Critical Vulnerabilities in Discontinued GMS Platform