Adobe Commerce/Magento CVE-2026-71362: Account Takeover Response Guide

Most account-takeover vulnerabilities require some prerequisite — a leaked password, a phishing click, a password-reset flow to abuse. This one requires none: the flaw lets an attacker directly assume any customer's authenticated session state, turning a storefront's normal 'logged in' assumption into an unreliable signal. For an e-commerce platform, that means stored payment methods, saved addresses, order history, and any admin-facing customer-service functions built on 'this session is who it claims to be' are all in scope simultaneously.

CISA added this CVE to KEV in the same batch as CVE-2026-5430 (WSO2, covered separately above) — both are unauthenticated, already-exploited-before-disclosure flaws in customer-facing platforms, and both warrant emergency patching ahead of routine release cycles.

Exposure is determined by product edition, version, and whether the July 2026 or later security patches have been applied.

• •Confirm whether the storefront runs Adobe Commerce, Adobe Commerce B2B, or Magento Open Source, and check the installed version/patch level against Adobe Security Bulletin APSB26-92's fixed-version table
• •Any deployment on or before the July 2026 patch baseline should be treated as vulnerable and prioritized regardless of apparent traffic volume — attacker targeting since August makes 'we're a small store' an insufficient risk assessment
• •Review application and WAF logs for anomalous session-identifier reuse or session-switching patterns — requests where the effective authenticated customer changes without a corresponding login event are the specific signature of this exploitation technique
• •Check for unauthorized order placements, address changes, or stored-payment-method access reported by customers around or after August 2026, since exploitation may have gone unnoticed if logs weren't specifically reviewed for this pattern

With confirmed in-the-wild exploitation predating disclosure by roughly a month, this should be treated as both a patch-now action and a retrospective compromise review, not just a forward-looking fix.

• •Apply Adobe Security Bulletin APSB26-92 immediately — this addresses CVE-2026-71362 along with six other vulnerabilities in the same isolated patch
• •Force-invalidate all active customer sessions after patching, since any session established before the fix may have been subject to the switching flaw
• •Audit order, account-detail-change, and payment-method logs from August 2026 forward for anomalies consistent with session hijacking, and notify affected customers per your data-breach obligations if unauthorized access is confirmed
• •Where immediate patching isn't possible, engage WAF rules to detect and block anomalous session-identifier switching patterns as a stopgap — Adobe has not published a configuration-only workaround, so this reduces rather than eliminates risk
• •Treat any confirmed account compromise as a full incident under your IR plan — see our ransomware IR playbook for the same NIST SP 800-61 containment-and-recovery structure, and our chain-of-custody guide if customer PII exposure requires evidentiary handling

An e-commerce platform handling customer PII and payment data that discloses this exposed a session-hijacking flaw exploited since August 2026 should expect this to be assessed as a 'known and preventable' gap under CERT-In's six-hour incident reporting mandate and, where applicable, DPDP Act breach-notification obligations, independent of whether the September 27 federal KEV deadline technically applies outside the U.S. federal estate. Confirm reporting timelines with legal counsel promptly if a compromise is confirmed, rather than waiting for the full technical investigation to conclude.