Adobe Commerce Bug Targeted Immediately After Disclosure
Hackers started targeting a fresh critical-severity Adobe Commerce vulnerability immediately after public disclosure, webstore security firm Sansec reports.
Tracked as CVE-2026-71362 (CVSS score of 9.1), the security defect is described as an incorrect authorization issue that allows unauthenticated attackers to elevate their privileges.
Adobe resolved the flaw on August 2026 Patch Tuesday, saying it had no evidence of in-the-wild exploitation, but warning that threat actors have targeted Commerce before.
Shortly after Adobe’s advisory was published, Sansec warned that it blocked the first exploitation attempts targeting the CVE.
According to Sansec, the flaw can be exploited by remote, unauthenticated attackers to take over other customer accounts.
“Sansec reviewed the patch and confirmed that the vulnerability lets attackers switch a customer session to another customer account. This gives them access to the victim’s account and private customer data,” the cybersecurity firm notes.
Advertisement. Scroll to continue reading.
Adobe resolved the underlying...
Copyright of this story solely belongs to securityweek.com. To see the full text click HERE
