Security AffairsPierluigi Paganini
Adobe Commerce CVE-2026-71362 exploited, accounts hijacked
Part of the CVE-2026-71362 story · since 13 Aug
- Thu 13 Aug, 14:31 UTC. SecurityWeek, first report. Adobe Commerce flaw CVE-2026-71362 lets attackers hijack accounts. Cites a CVE in CISA KEV.
- Thu 13 Aug, 18:26 UTC. Security Affairs, its first report on the story. Adobe Commerce CVE-2026-71362 exploited, accounts hijacked. Cites a CVE in CISA KEV. This article, 2nd of 6.
- Fri 28 Aug, 03:32 UTC. SecurityOnline, its first report on the story. CVE-2026-71362 Exploited: Adobe Commerce Account Takeover, Details and PoC are Public. Cites a CVE in CISA KEV.
- Thu 24 Sep, 20:01 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Critical Flaw in Adobe Commerce. Cites a CVE in CISA KEV.
- Fri 25 Sep, 03:47 UTC. SecurityOnline. CISA Warns of Exploited WSO2 and Adobe Commerce Flaws. Cites a CVE in CISA KEV.
- Fri 25 Sep, 09:30 UTC. Security Affairs. CISA Flags Critical WSO2 and Magento Flaws Used in Attacks. Cites a CVE in CISA KEV.
Adobe Commerce's critical flaw, CVE-2026-71362, has come under attack shortly after its public disclosure, allowing unauthenticated attackers to hijack customer accounts and access sensitive data. Registered with a CVSS score of 9.1, the vulnerability affects multiple Adobe Commerce versions. Following the disclosure, cybersecurity firm Sansec reported blocking early exploitation attempts. Adobe has released patches that address this and other vulnerabilities, advising users to update their systems immediately. The exploit does not require prior account access or user interaction, heightening security concerns.
How the story developed
6 articles from 4 outlets since 13 Aug. Quiet since 25 Sep. This was the 2nd report, 4 hours after the first.
- Thu 13 Aug, 14:31 UTC. SecurityWeek, first report. Adobe Commerce flaw CVE-2026-71362 lets attackers hijack accounts. Cites a CVE in CISA KEV.
- Thu 13 Aug, 18:26 UTC. Security Affairs, its first report on the story. Adobe Commerce CVE-2026-71362 exploited, accounts hijacked. Cites a CVE in CISA KEV. This article, 2nd of 6.
- Fri 28 Aug, 03:32 UTC. SecurityOnline, its first report on the story. CVE-2026-71362 Exploited: Adobe Commerce Account Takeover, Details and PoC are Public. Cites a CVE in CISA KEV.
- Thu 24 Sep, 20:01 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Critical Flaw in Adobe Commerce. Cites a CVE in CISA KEV.
- Fri 25 Sep, 03:47 UTC. SecurityOnline. CISA Warns of Exploited WSO2 and Adobe Commerce Flaws. Cites a CVE in CISA KEV.
- Fri 25 Sep, 09:30 UTC. Security Affairs. CISA Flags Critical WSO2 and Magento Flaws Used in Attacks. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 6 articles as a listHide the list
- Thu 13 AugDay 02
- Adobe Commerce flaw CVE-2026-71362 lets attackers hijack accounts14:31 · SecurityWeek · First report · Exploited CVE · Known exploited CVE
- Adobe Commerce CVE-2026-71362 exploited, accounts hijacked18:26 · Security Affairs · Known exploited CVE · This article, 2nd of 6
Quiet for 2 weeks
Fri 28 AugDay 151- CVE-2026-71362 Exploited: Adobe Commerce Account Takeover, Details and PoC are Public03:32 · SecurityOnline · Picked up again · Known exploited CVE
Quiet for 4 weeks
Thu 24 SepDay 421- CISA Flags Actively Exploited Critical Flaw in Adobe Commerce20:01 · CISA · official · CISA alert · Picked up again · Known exploited CVE
- Fri 25 SepDay 432
- CISA Flags Critical WSO2 and Magento Flaws Used in Attacks09:30 · Security Affairs · Known exploited CVE