Adobe Commerce session flaw lets unauthenticated attackers take over customer accounts

Adobe patched a critical flaw in its Commerce and Magento e-commerce platforms that lets an unauthenticated attacker hijack customer accounts, and security firm Sansec reports its web application firewall is already blocking exploitation attempts. Tracked as CVE-2026-71362 and scored 9.1, the incorrect-authorization bug stems from the platform failing to bind a customer identity to an account session, so an attacker with only network access to the public storefront can switch an active session to another customer and read their private data. It needs no account, administrator rights, or user interaction. Adobe ships the fix as isolated patch files, so administrators must be on the latest point release first.

Check

Apply Adobe's August isolated patch for Commerce, Commerce B2B, and Magento after confirming you are on the latest point release for your branch, and treat exploitation traffic as already present.

Affected

Merchants running Adobe Commerce 2.4.4 to 2.4.9 or Magento Open Source 2.4.6 to 2.4.9 (CVE-2026-71362); an unauthenticated visitor can switch into another customer's session and access their account data.

Fix

Patch promptly, put a web application firewall in front of the storefront, review privileged account activity and unexpected configuration changes, and validate extension integrity on internet-facing Commerce instances.