CVE-2026-71362Active Exploitation(adobe / commerce)

A PoC/exploit has been discovered for vulnerability CVE-2026-71362 Vendor: Adobe Product: Adobe Commerce Description: Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction. Link: https://github.com/dinosn/cve-2026-71362-magento-lab #dbugs_vuln

Docker lab reproducing CVE-2026-71362 (Adobe Commerce / Magento Open Source customer-session identity-switch account takeover, APSB26-92, CVSS 9.1) https://github.com/dinosn/cve-2026-71362-magento-lab

🛡️We added WSO2 path traversal vulnerability CVE-2026-5430 & Adobe Commerce & Magento incorrect authorization vulnerability CVE-2026-71362 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity #InfoSec https://t.co/gCOou6c0gX

🚨 CISA KEV — ADOBE COMMERCE / MAGENTO CVE-2026-71362 (INCORRECT AUTHORIZATION → PRIVILEGE ESCALATION) CISA added CVE-2026-71362 to its Known Exploited Vulnerabilities (KEV) Catalog on September 24, 2026, based on evidence of active exploitation. Product: Adobe Commerce and Magento Open Source (also covered under APSB26-92 with Commerce B2B) Issue: Incorrect Authorization (CWE-863) Impact (vendor): Privilege escalation — Critical CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N); authentication not required; admin privileges not required Vendor bulletin: APSB26-92 (published August 11, 2026; Priority 2) — August 2026 security update lines for Commerce / Magento Open Source / Commerce B2B Federal due date: September 27, 2026 (BOD 26-04); forensic triage: Yes Affected (vendor table, examples): Adobe Commerce and Magento Open Source 2.4.9-2026-jul and earlier (and listed 2.4.8–2.4.4 / B2B lines) — update to the corresponding 2026-aug builds per APSB26-92. ⚠️ Analyst Note: This is an official CISA KEV addition (catalogVersion 2026.09.24; count 1723) plus Adobe’s official security bulletin. Prefer those primaries over secondary media. APSB26-92 itself was published August 11, 2026 and stated Adobe was not aware of in-the-wild exploits for the issues in that bulletin at publication time. CISA’s September 24 KEV add is the new signal: evidence of active exploitation for CVE-2026-71362. Frame as KEV / active exploitation urgency on a previously released Critical Commerce/Magento fix — not as a brand-new Adobe disclosure. CISA has not published a detailed exploitation-campaign narrative in the KEV entry; treat “known exploited” as the authoritative urgency signal and apply vendor patches / BOD 26-04 guidance. Official vendor bulletin: https://helpx.adobe.com/security/products/magento/apsb26-92.html CISA alert (two-KEV add): https://www.cisa.gov/news-events/alerts/2026/09/24/cisa-adds-two-known-exploited-vulnerabilities-catalog CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog #DDW #DarkWeb #CISA #KEV #Adobe #Magento #Commerce #CVE202671362 #ThreatIntelligence #CyberSecurity

🚨 CRITICAL: CVE-2026-71362 (CVSS 9.1) is being exploited against Adobe Commerce & Magento Open Source. The unauthenticated flaw allows attackers to hijack customer sessions and take over accounts, gaining access to private customer data — with no account or user interaction required. A public PoC/lab is now available, while exploitation attempts have already been observed. 🔴 Patch immediately with Adobe’s APSB26-92 security update. 🔗 https://sansec.io/research/adobe-commerce-account-takeover-apsb26-92 🔗 PoC/Lab: https://github.com/dinosn/cve-2026-71362-magento-lab #AdobeCommerce #Magento #CVE #AccountTakeover #WebSecurity #CyberSecurity #Infosec

🚨 CVE-2026-71362 - critical 🚨 Adobe Commerce/Magento - Customer Session Identity Switch > Adobe Commerce contains an incorrect authorization vulnerability caused by improper a... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-71362 @pdnuclei #NucleiTemplates #cve

Attackers exploit CVE-2026-71362, an unauthenticated Adobe Commerce account takeover flaw (CVSS 9.1). Details and PoC are public. Patch now. #AdobeCommerce #Magento #CVE202671362 #AccountTakeover #ecommerce #InfoSec https://securityonline.info/adobe-commerce-vulnerability-cve-2026-71362/

ARETIQ Daily Vulnerability Bulletin — August 11, 2026 🔴 CRITICAL: CVE-2026-48362 (adobe/coldfusion_2025) AAS 13.8 🔴 CRITICAL: CVE-2026-71362 (adobe/adobe_commerce) AAS 13.8 — PoC available 🔴 CRITICAL: CVE-2026-72785 (craftcms/cms) AAS 13.5 — PoC available 🔴 CRITICAL: CVE-2026-72920 (seaweedfs/seaweedfs) AAS 13.1 — PoC available 🔴 CRITICAL: CVE-2026-46670 (yeswiki/yeswiki) AAS 12.4 — PoC available + 4 more CRITICAL 111 vulnerabilities — CRITICAL: 9, HIGH: 102 Full bulletin: https://aretiq.ai/bulletins/2026-08-11/

🔴 Adobe Commerce ve Magento Open Source'u etkileyen CVE-2026-71362 için PoC yayınlandı. Bu açık CVSS: 9.1 (Critical), Kimlik doğrulama veya kullanıcı etkileşimi gerektirmiyor. Hatalı yetkilendirme üzerinden yetki yükseltmeye yol açabiliyor. Adobe, açığı Ağustos 2026 güvenlik güncellemelerinde giderdi. Güncel olmayan Adobe Commerce/Magento kurulumlarının vakit kaybetmeden kontrol edilmesi öneriliyor. ⚠️ İnternete açık Magento mağazalarında özellikle eski security build'leri kullanan yöneticilerin sürümlerini kontrol etmesi önemli. PoC: https://github.com/dinosn/cve-2026-71362-magento-lab

Your Magento storefront can be jumped to higher privileges with no login. CISA put this on KEV today (due Sep 27). Move to the August security train: https://hol.org/blog/cve-2026-71362-adobe-commerce-magento-authz-kev https://t.co/0JQ4gtQcqA

🚨 Acaba de confirmarse que hackers están explotando una vulnerabilidad crítica en Adobe Commerce, CVE-2026-71362, que permite a atacantes no autenticados secuestrar cuentas de clientes y acceder a datos privados, con una puntuación CVSS de 9.1. Adobe Commerce es el objetivo, y la vulnerabilidad CVE-2026-71362 es la puerta de entrada. El ataque permite a los hackers switchear sesiones de clientes, hijackear cuentas y acceder a información privada. La explotación de esta vulnerabilidad puede tener un impacto significativo en las tiendas en línea que utilizan Adobe Commerce, ya que los atacantes pueden acceder a información confidencial de los clientes. El parche para esta vulnerabilidad es crucial. Si estás utilizando Adobe Commerce, es fundamental que actualices tu sistema lo antes posible. ¿Estás en riesgo? Revisa esto: actualiza Adobe Commerce y verifica los logs de seguridad para detectar cualquier actividad sospechosa. #Ciberseguridad #CVE #SeguridadDigital #Threat https://securityaffairs.com/197149/hacking/adobe-commerce-cve-2026-71362-comes-under-attack-shortly-after-public-disclosure.html

🚨 August 20, 2026 Patches: CISA orders patching of 3 critical flaws by August 21. - Microsoft IKE (CVE-2026-33824, CVSS 9.8) - Adobe Commerce (CVE-2026-71362 CVSS 9.8) - SharePoint (CVE-2026-55040, CVSS 9.1) https://cert.ug | #CyberSafeUG #CERTUGCC https://t.co/86SXyzwJO2

🚨CISA ADDS WSO2 AND ADOBE COMMERCE FLAWS TO KEV CISA has added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog after evidence of exploitation in real attacks. 🔴 CVE-2026-5430 CVSS: 9.8 Affects multiple WSO2 products including API Manager and Universal Gateway. The path-traversal flaw can enable unrestricted file upload and ultimately remote code execution. 🔴 CVE-2026-71362 CVSS: 9.1 Affects Adobe Commerce and Magento. Attackers can potentially abuse the authorization flaw to gain elevated access to sensitive resources without user interaction. CISA has instructed U.S. federal civilian agencies to remediate both vulnerabilities by September 27, 2026. 🛡️ Defender priority: Internet-facing WSO2 and Adobe Commerce environments should be treated as urgent remediation targets. Sources: The Hacker News · SecurityAffairs.

2. CVE-2026-71362 (@Adobe Commerce / @Magento incorrect authorization → session switch / account takeover) This flaw allows an attacker to switch a customer session to another account and access private customer data without user interaction.

CISA added CVE-2026-5430 to the exploited catalogue on Wednesday with a three day deadline. The record contradicts itself. 📄 Its name: "WSO2 Multiple Products Path Traversal Vulnerability". Its description: a path traversal allowing unrestricted file upload and remote code execution. Its CWE field, in the same record: CWE-347, improper verification of a cryptographic signature. The two pages the record links to, WSO2's own advisory and the NVD entry, both describe a third thing that matches the CWE and not the name: JWT authentication is bypassed when a token is signed with an algorithm the server does not support. Neither source contains the words path traversal. Neither mentions file upload. 🔎 This matters because the name is what travels. Triage from it and you go hunting for dot dot slash sequences in web server logs, files written outside their directory, web shells in upload folders, traversal coverage in your WAF. You will find nothing. The real flaw leaves none of those traces: it produces a correctly formed authenticated request, and potentially an administrative session. The machine readable field was right. The two fields written by hand were wrong. Guess which one your vulnerability platform puts on the ticket. 🧾 The rest of the record, for anyone triaging it now. CVSS 10.0, assigned by WSO2 as CNA, reduced by WSO2 itself to 9.8 for single tenant deployments. NVD has published no score of its own. Affected: API Control Plane, Traffic Manager and Universal Gateway 4.5.0 and 4.6.0, API Manager 4.1.0 through 4.6.0. Credited to the Hacktron Team. ⏳ The vendor advisory is dated 3 May. NVD published on 6 August. The catalogue entry landed 144 days after the advisory, with a deadline of three days, under BOD 26-04, flagged for forensic triage. ⚖️ The control in the experiment is the other entry added the same day. Adobe Commerce CVE-2026-71362: KEV name, CWE-863 and Adobe's own bulletin all agree. Same team, same release, one right and one wrong. 📌 Change the habit. Read the cwes field and the linked vendor advisory before the vulnerabilityName. One of those is written by a machine. https://www.pk-sharma.com/briefing/kev-entry-describes-the-wrong-flaw #ThreatIntel #VulnerabilityManagement #KEV #CISA #WSO2 #Adobe #APISecurity #JWT #PatchManagement #InfoSec #CyberSecurity #BlueTeam #SOC #CISO

#Adobe #Commerce CVE-2026-71362 Comes Under Attack Shortly After Public Disclosure https://securityaffairs.com/197149/hacking/adobe-commerce-cve-2026-71362-comes-under-attack-shortly-after-public-disclosure.html #securityaffairs #hacking

🚨 Last 24h is HOT — primary sources only CISA added 3 KEVs on 11 Aug (all actively exploited): • CVE-2026-20349 — Cisco ASA/FTD unauth SSL VPN DoS Official: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF Fed deadline: 14 Aug. No workarounds. Hotfix now. • CVE-2026-68820 — Windows afd.sys LPE (SYSTEM) Microsoft: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820 Lazarus (Operation Dream Job) weaponizing it since early July against defense targets. Patch + reboot. • CVE-2026-72898 — Metabase unauth SQLi → admin takeover https://www.metabase.com/blog/security-update https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf Already hit Framework, Tally, n8n. Block /api/session/reset_password or upgrade immediately. Fed deadline 14 Aug. Also tracking: Adobe Commerce session hijacks (CVE-2025-54236 SessionReaper + fresh CVE-2026-71362) SentinelOne: https://www.sentinelone.com/vulnerability-database/cve-2025-54236/ Adobe APSB26-92: https://helpx.adobe.com/security/products/magento/apsb26-92.html • ShieldBreak — new Microsoft Defender SYSTEM bypass post-Patch Tuesday. Hunt it. Priority this week: 1. Hotfix Cisco ASA/FTD 2. Patch Windows + reboot 3. Upgrade/block Metabase 4. Apply Adobe APSB26-92 5. Hunt ShieldBreak Full CISA alert: https://www.cisa.gov/news-events/alerts/2026/08/11/cisa-adds-three-known-exploited-vulnerabilities-catalog Verified under primary-source check. @seoscottsdale @CipherWardenAI @CISAgov @CISACyber @Cisco @msftsecresponse @metabase What’s your biggest exposure right now — firewalls, BI tools, or Windows endpoints? #Cybersecurity #AISecurity #KEV #Lazarus

CVE-2026-71362, CVSS 9.1. Adobe Commerce and Magento fail to bind customer identity to session, so an unauthenticated attacker can hijack another customer's account. No login, no admin, no click needed. Sansec saw real attacks within hours of disclosure. CISA KEV since Sept 24. https://t.co/Eth8Wuzt5r

Adobe Commerce / Magento — CVE-2026-71362 A pre-auth privilege escalation, CVSS 9.1, is now in CISA KEV after evidence of active exploitation. Adobe patched it in August. If you're still on a pre-August security build, this just became urgent. 3/5

Sansec caught Magento shops getting account-switched with zero clicks and no login. Adobe Commerce CVE-2026-71362 is on the KEV list now, due Sunday. If we still run Magento, I'm confirming the August patch landed before weekend store traffic.