Adobe's regular August security update, released on 11 August, patched seven vulnerabilities in Adobe Commerce and Magento Open Source — the most serious being CVE-2026-71362, a CVSS 9.1 flaw that lets an attacker take over a customer's account without ever logging in. The bug sits in how Magento handles customer identity inside the account session: exploiting it lets an attacker switch an active session so it points at a different customer's account, no password, no admin access, and no click from the victim required. Adobe says it isn't aware of exploitation in the wild, but Sansec, the eCommerce security firm that reviewed the patch, reports its own web application firewall is already blocking live attempts against the flaw — a sign attackers found it fast. The same update also fixed an authorization bypass (CVE-2026-48416, CVSS 7.5) and two stored cross-site scripting flaws, but the account-takeover bug is the one worth acting on first.
Once inside a hijacked session, an attacker sees whatever that customer sees: saved addresses, order history, stored payment details on file, and any account-level actions the storefront allows. The flaw affects Adobe Commerce and Magento Open Source versions 2.4.4 through 2.4.9 that haven't applied the August patch, which Adobe shipped as isolated patch files rather than a full version release — stores need to be on their latest supported "-p" build before the isolated fix will apply cleanly.
What this means for your business
If your store runs on Adobe Commerce or Magento Open Source, get the August 2026 patch applied this week — check with whoever manages your hosting or platform that the isolated fix for CVE-2026-71362 is actually installed, not just scheduled. Because this flaw needs no credentials and no user interaction, "we haven't seen anything suspicious" isn't a reliable signal that you're safe; the absence of an alarm doesn't mean the door was locked. If your Magento install is old, unmaintained, or nobody currently owns patching it, that's the bigger underlying risk this incident points at: an e-commerce platform running customer accounts and payment data needs a clear owner for security updates, not an occasional check when something breaks.