Why Adobe Commerce Vulnerability Lets Hackers Hijack Accounts

On August 11, 2026 Adobe released an update that patched seven vulnerabilities, one of which – CVE-2026-71362 – lets attackers hijack customer accounts without any authentication. That’s the most alarming part of the release, because the flaw lets a malicious actor switch a victim’s session to another shopper’s account, opening the door to private data theft.

Historical Context

Adobe Commerce and Magento Open Source have long been pillars of online retail. Over the years, the platforms have faced a series of security advisories that prompted routine patch cycles. Each cycle typically bundles fixes for multiple CVEs, reflecting both legacy code concerns and emerging attack techniques. The August 2026 update follows that pattern, delivering a focused remedy for a session‑handling weakness while also tightening other attack surfaces.

Past advisories have highlighted issues ranging from cross‑site scripting to privilege‑escalation bugs. Those precedents taught the community that even well‑tested e‑commerce stacks can harbor logic errors that slip past standard testing. The current patch therefore represents both a response to a specific flaw and a reminder of the ongoing arms race between developers and attackers.

Key Takeaways

• Adobe Commerce and Magento Open Source were vulnerable to an unauthenticated session‑swap attack (CVE-2026-71362).
• Sansec’s Shield WAF is already blocking exploitation attempts, but many sites remain exposed.
• The patch fixes the flaw by correcting how Magento handles customer identity in session data.
• Adobe recommends applying the August 2026 security update immediately across all supported release lines.
• Four of the seven fixes carry a CVSS score of 7.5 or higher, indicating high severity.

Adobe Commerce vulnerability Exposes Customer Sessions

The vulnerability is described as an “incorrect authorization” issue that can be used to “gain elevated access to sensitive resources” without any authentication. That phrasing comes straight from Adobe’s advisory, and it matches what Sansec observed in the wild. The company’s Shield web application firewall is already seeing exploitation attempts, even though Adobe says it isn’t aware of any confirmed wild exploits.

It doesn’t require an existing account, admin rights, or any user interaction. That’s how the attack bypasses typical security controls – by hijacking the session itself. The flaw stems from Magento’s mishandling of the customer identity field inside an account session, allowing an attacker to swap the session’s owner.

Sansec reviewed the patch and confirmed that the vulnerability lets attackers switch a customer session to another customer account. This gives them access to the victim’s account and private customer data.

How the Exploit Works

In simple terms, the attacker sends a crafted request that tricks Magento into believing the session belongs to a different shopper. Because the platform doesn’t verify the session’s original owner, the request succeeds, and the attacker gains full access to the target account. That’s the catch.

There’s no need for the attacker to guess passwords or compromise admin accounts. It’s a pure logic error that bypasses the authentication step entirely. Once inside, the malicious user can view order histories, personal details, and potentially inject malicious payloads into the victim’s shopping experience.

Other Critical Flaws Fixed in the Same Update

Adobe didn’t just patch the session‑swap bug. The August 2026 update also addressed six additional vulnerabilities, four of which received a high‑severity CVSS score. Below is a quick rundown of those issues:

• CVE-2026-48414 (7.7) – Stored XSS that could lead to arbitrary code execution. Requires authentication and admin privileges.
• CVE-2026-48413 (8.7) – Stored XSS allowing arbitrary code execution. Requires authentication but not admin privileges.
• CVE-2026-48415 (7.6) – Incorrect‑authorization bug in Adobe Commerce B2B that could bypass a security feature. Requires authentication, no admin needed.
• CVE-2026-48416 (7.5) – Incorrect‑authorization issue that could bypass a security feature. No authentication or admin rights required.
• CVE-2026-48411 (6.5) – Incorrect‑authorization flaw needing authentication and admin privileges.
• CVE-2026-48412 (2.7) – Incorrect‑authorization bug that could lead to privilege escalation. Needs authentication and admin privileges.

These numbers matter because they give a sense of the overall risk landscape. A 7.5‑plus CVSS score signals a vulnerability that’s easy to exploit and can cause serious damage. That’s why Adobe’s advisory emphasizes immediate patching.

Patch Deployment: What Admins Need to Know

Adobe distributes the fixes as isolated patch files rather than a single bundled release. That means administrators must first confirm they’re on the latest “‑p” release for their branch, then apply the relevant patch. The process isn’t complicated, but it does require careful inventory of all Magento instances.

It’s easy to miss a step. If you skip the prerequisite “‑p” upgrade, the patch won’t apply cleanly, leaving the site vulnerable. That’s why many security teams are automating the version check before rolling out the isolated patches.

Best‑Practice Checklist

• Verify current version includes the latest “‑p” release.
• Download the isolated patch for CVE-2026-71362 from Adobe’s security page.
• Apply the patch in a staging environment first.
• Run regression tests focusing on checkout and login flows.
• Deploy to production during a low‑traffic window.
• Monitor logs for any Shield WAF alerts post‑deployment.

That checklist isn’t exhaustive, but it covers the essentials. It’s also a good idea to coordinate with your CDN or WAF provider – like Sansec – to ensure they have the latest signatures for blocking attempts.

Why This Vulnerability Is Particularly Concerning

Most e‑commerce platforms rely on session cookies to maintain a shopper’s state. If an attacker can hijack that session without needing to crack passwords, the breach bypasses the most fundamental security layer. That’s why the flaw is deemed “critical” by Adobe.

It’s also ironic that the issue stems from a simple mishandling of a customer‑identity field – a piece of data that should be the most guarded. The oversight shows that even mature platforms can have blind spots when it comes to session management.

According to the Blue Report 2026, once attackers have valid credentials, only 37% of their actions are blocked. That statistic underscores how quickly defenses erode after an initial foothold is gained. In this case, the foothold comes without any credentials at all.

What This Means For You

If you run an Adobe Commerce or Magento store, you need to treat this patch like a fire‑drill. Deploy the isolated patch for CVE-2026-71362 today, and verify that your WAF is running the latest Shield signatures. Don’t assume that because Adobe hasn’t seen wild exploits yet, you’re safe – the evidence from Sansec shows attempts are already underway.

Beyond patching, consider implementing additional session hardening measures: rotate session IDs on login, enforce short session lifetimes, and use HTTP‑only, secure cookies. Those steps won’t stop the vulnerability itself, but they’ll reduce the window an attacker has to exploit a hijacked session.

Concrete Scenarios

A boutique apparel shop that handles a few hundred transactions a day could see a single compromised account lead to a cascade of fraudulent orders. The attacker could place high‑value purchases using the victim’s saved payment method, then ship the items to an address of their choosing. The shop would bear charge‑back fees and damage to its reputation.

A large marketplace that aggregates dozens of independent sellers might experience a different impact. If an attacker swaps sessions between two customers, they could view private seller analytics, extract sales data, or even manipulate product listings. That exposure could give competitors an unfair advantage or enable targeted phishing campaigns.

An enterprise B2B portal that uses Adobe Commerce for internal procurement could suffer operational disruption. A malicious actor gaining access to a procurement manager’s account could approve or reject purchase orders, altering supply‑chain flows. The resulting delays could translate into missed deadlines and contractual penalties.

Looking Ahead

Will future Adobe releases address the root cause of session‑handling errors, or will we keep seeing isolated patches for each new flaw? The answer will shape how e‑commerce operators prioritize security budgeting for the next year.

For now, the onus is on site owners to act fast. The longer a vulnerable version stays online, the higher the chance an attacker will successfully swap a customer session and walk away with sensitive data.

Key Questions Remaining

• Will Adobe integrate more strong session validation checks into the core codebase, reducing reliance on patch‑level fixes?
• How quickly can WAF providers roll out updated signatures after a new vulnerability is disclosed?
• What additional monitoring practices can organizations adopt to detect session‑swap attempts before they succeed?

Sources: BleepingComputer, Adobe Security Advisory (APS B26‑92)

Primary sources: helpx.adobe.com (Vendor advisory for CVE-2026-71362).