CISA added CVE-2026-71362 to the Known Exploited Vulnerabilities catalog on 24 September 2026 (FCEB due 27 Sep) as an incorrect-authorization flaw in Adobe Commerce and Magento Open Source that can elevate access to sensitive resources without user interaction.

Sansec (11 August 2026) reviewed Adobe APSB26-92 isolated patches and confirmed the bug lets an unauthenticated attacker switch a customer session to another customer account (account takeover / private customer data). APSB26-92 is a multi-CVE isolated-patch package (seven flaws; five Critical including this CVSS 9.1 item) — not a full Composer security release; merchants must be on the latest -p line for their release before applying the isolated patch.

Affected, per Adobe's CVE record: Adobe Commerce through 2.4.9-2026-jul / 2.4.8–2.4.4-2026-aug lines; Magento Open Source through corresponding -jul lines; Adobe Commerce B2B through listed -jul lines — patched in the matching 2026-aug isolated/security levels per APSB26-92. (sources: CISA KEV alert; Adobe APSB26-92; Sansec)

Correction (27 Oct 2026): removed a claim that Previdian sensors saw exploitation attempts from an Australia-geolocated IP on 10 September, and a line crediting The Hacker News, because neither source is linked; Adobe's APSB26-92 bulletin returns 403 to Cyberstack. The affected versions are now credited to Adobe's CVE record. (source: CISA; Sansec; CVE.org)