SecurityWeekIonut Arghire
Adobe Commerce flaw CVE-2026-71362 lets attackers hijack accounts
Part of the CVE-2026-71362 story · since 13 Aug
- Thu 13 Aug, 14:31 UTC. SecurityWeek, first report. Adobe Commerce flaw CVE-2026-71362 lets attackers hijack accounts. Cites a CVE in CISA KEV. This article, 1st of 6.
- Thu 13 Aug, 18:26 UTC. Security Affairs, its first report on the story. Adobe Commerce CVE-2026-71362 exploited, accounts hijacked. Cites a CVE in CISA KEV.
- Fri 28 Aug, 03:32 UTC. SecurityOnline, its first report on the story. CVE-2026-71362 Exploited: Adobe Commerce Account Takeover, Details and PoC are Public. Cites a CVE in CISA KEV.
- Thu 24 Sep, 20:01 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Critical Flaw in Adobe Commerce. Cites a CVE in CISA KEV.
- Fri 25 Sep, 03:47 UTC. SecurityOnline. CISA Warns of Exploited WSO2 and Adobe Commerce Flaws. Cites a CVE in CISA KEV.
- Fri 25 Sep, 09:30 UTC. Security Affairs. CISA Flags Critical WSO2 and Magento Flaws Used in Attacks. Cites a CVE in CISA KEV.
The article reports on a recent critical-severity vulnerability in Adobe Commerce, tracked as CVE-2026-71362, which has a CVSS score of 9.1. The flaw, described as an incorrect authorization issue, allows unauthenticated attackers to elevate privileges and take over customer accounts. This vulnerability was publicly disclosed by Adobe and quickly targeted by hackers, prompting immediate action from webstore security firm Sansec, which reported blocking exploitation attempts.
Adobe released a patch to fix this issue and six other vulnerabilities, emphasizing the need for users to apply updates promptly to prevent potential exploitation. The flaw affects multiple versions of Adobe Commerce, including Commerce B2B and Magento Open Source.
How the story developed
6 articles from 4 outlets since 13 Aug. Quiet since 25 Sep. This was the first report.
- Thu 13 Aug, 14:31 UTC. SecurityWeek, first report. Adobe Commerce flaw CVE-2026-71362 lets attackers hijack accounts. Cites a CVE in CISA KEV. This article, 1st of 6.
- Thu 13 Aug, 18:26 UTC. Security Affairs, its first report on the story. Adobe Commerce CVE-2026-71362 exploited, accounts hijacked. Cites a CVE in CISA KEV.
- Fri 28 Aug, 03:32 UTC. SecurityOnline, its first report on the story. CVE-2026-71362 Exploited: Adobe Commerce Account Takeover, Details and PoC are Public. Cites a CVE in CISA KEV.
- Thu 24 Sep, 20:01 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Critical Flaw in Adobe Commerce. Cites a CVE in CISA KEV.
- Fri 25 Sep, 03:47 UTC. SecurityOnline. CISA Warns of Exploited WSO2 and Adobe Commerce Flaws. Cites a CVE in CISA KEV.
- Fri 25 Sep, 09:30 UTC. Security Affairs. CISA Flags Critical WSO2 and Magento Flaws Used in Attacks. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 6 articles as a listHide the list
- Thu 13 AugDay 02
- Adobe Commerce flaw CVE-2026-71362 lets attackers hijack accounts14:31 · SecurityWeek · First report · Exploited CVE · Known exploited CVE · This article, 1st of 6
- Adobe Commerce CVE-2026-71362 exploited, accounts hijacked18:26 · Security Affairs · Known exploited CVE
Quiet for 2 weeks
Fri 28 AugDay 151- CVE-2026-71362 Exploited: Adobe Commerce Account Takeover, Details and PoC are Public03:32 · SecurityOnline · Picked up again · Known exploited CVE
Quiet for 4 weeks
Thu 24 SepDay 421- CISA Flags Actively Exploited Critical Flaw in Adobe Commerce20:01 · CISA · official · CISA alert · Picked up again · Known exploited CVE
- Fri 25 SepDay 432
- CISA Flags Critical WSO2 and Magento Flaws Used in Attacks09:30 · Security Affairs · Known exploited CVE