VulnSocial

CVE-2026-48416Active Exploitation(adobe / commerce)

MEDIUMCVSS 7.5 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch adobe commerce systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.

adobe CVEsBack to dashboard
4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-863

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • commerce
  • commerce_b2b
  • magento

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Affected systems

Vendors
adobe
Products
commercecommerce_b2bmagento

10 versions affected across 3 products

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-08-12: 1Active Exploitation · 2026-08-12: 1Patch / Workaround · 2026-08-12: 1Technical Details · 2026-08-12: 108-12
Signal classification1 categories
Active Exploitation
1100.0%
Referenced assets1 URL
Full discourse1 post
  • yousukezan@yousukezan
    Active Exploitation

    Adobe CommerceとMagentoに、認証なしで他の顧客アカウントへセッションを切り替えられる重大な脆弱性CVE-2026-71362が見つかり、悪用を試みる通信がすでに観測されている。攻撃者は既存アカウントや管理者権限、ユーザー操作を必要としない。 Sansecによると、Adobeの修正内容を分析した結果、Magentoがアカウントセッション内の顧客IDを不適切に扱っており、攻撃者が自身のセッションを別の顧客アカウントへ切り替えられることを確認した。これにより被害者アカウントや非公開の顧客データへアクセスできる。 Adobeは同日に計7件を修正した。ほかには、保存型XSSのCVE-2026-48414とCVE-2026-48413、認可不備のCVE-2026-48415、CVE-2026-48416、CVE-2026-48411、CVE-2026-48412が含まれる。 Adobeはアドバイザリで実際の悪用を把握していないとしている一方、Sansecは自社WAFでCVE-2026-71362の悪用試行をすでに遮断していると説明した。管理者には、対応する最新の-pリリースへ更新したうえで、2026年8月の個別パッチを適用するよう案内されている。 https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-adobe-commerce-flaw-to-hijack-customer-accounts/

    Post summary

    Adobe Commerce and Magento suffer a CVE‑2026‑71362 session‑hijack flaw actively attempted in the wild; Adobe has issued patches and urges administrators to update promptly.

    000211.4K
    15.0K followersView on X
CPE platform detail125 entries

125 of 125 entries

PartVendorProductVersionTarget SWTarget HW
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.7--
Appadobecommerce2.4.7--
Appadobecommerce2.4.7--
Appadobecommerce2.4.7--
Appadobecommerce2.4.7--
Appadobecommerce2.4.7--
Appadobecommerce2.4.7--
Appadobecommerce2.4.7--
Appadobecommerce2.4.7--
Appadobecommerce2.4.7--
Appadobecommerce2.4.8--
Appadobecommerce2.4.8--
Appadobecommerce2.4.8--
Appadobecommerce2.4.8--
Appadobecommerce2.4.8--
Appadobecommerce2.4.9--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.3.5--
Appadobecommerce_b2b1.3.5--
Appadobecommerce_b2b1.3.5--
Appadobecommerce_b2b1.3.5--
Appadobecommerce_b2b1.3.5--
Appadobecommerce_b2b1.3.5--
Appadobecommerce_b2b1.3.5--
Appadobecommerce_b2b1.4.2--
Appadobecommerce_b2b1.4.2--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.7--
Appadobemagento2.4.7--
Appadobemagento2.4.7--
Appadobemagento2.4.7--
Appadobemagento2.4.7--
Appadobemagento2.4.7--
Appadobemagento2.4.7--
Appadobemagento2.4.7--
Appadobemagento2.4.7--
Appadobemagento2.4.7--
Appadobemagento2.4.8--
Appadobemagento2.4.8--
Appadobemagento2.4.8--
Appadobemagento2.4.8--
Appadobemagento2.4.8--
Appadobemagento2.4.9--

Explore more

Back to dashboardadobe CVEscommerce vulnerabilities