Is CVE-2026-71362 actively exploited?

Yes. Previdian has observed exploitation attempts targeting this CVE. Confidence is confirmed.

What exploitation activity has Previdian observed?

Previdian sensors have observed 1 exploitation attempt, 1 unique attacker IP, and 1 country targeting CVE-2026-71362. First observed Sep 10, 2026.

How should organizations remediate it?

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.

No. CVE-2026-71362 is not currently listed in CISA KEV.

CVE-2026-71362 Exploitation Observed — Adobe Commerce, Adobe Commerce B2B, Magento Open Source

Q: Which versions are affected?

CVE-2026-71362 affects Adobe Adobe Commerce and 2 other products. Previdian lists 6 version rows; examples include 0 to <= 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug, 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug, and 0 to <= 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul.

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-71362 is an unauthenticated vulnerability affecting Adobe Adobe Commerce and 2 other products. Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation....

Is it exploited?

Yes. Previdian sensors observed exploitation attempts with confirmed confidence.

Who is affected?

Adobe / Adobe Commerce 0 to <= 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug.

What should we do?

Patch immediately, validate internet-facing exposure, and monitor for matching requests.

Overview

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources.

Exploitation of this issue does not require user interaction.

Vendor Product Affected Status

Adobe Affected

Adobe Commerce

Through 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug

Affected

Adobe Unaffected

Adobe Commerce

2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug

Unaffected

Adobe Affected

Adobe Commerce B2B

Through 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul

Affected

Adobe Unaffected

Adobe Commerce B2B

1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug

Unaffected

Adobe Affected

Magento Open Source

Through 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul

Affected

Adobe Unaffected

Magento Open Source

2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug

Unaffected

View vendor advisory

Published: 11 Aug 2026
Exploitation Reported: 10 Sep 2026
Attack vector: Remote
Complexity: Low
Privileges: None
User interaction: None

CVE References

CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2026-71362
Vendor Advisory — helpx.adobe.com helpx.adobe.com · Vendor Advisory https://helpx.adobe.com/security/products/magento/apsb26-92.html

Exploitation evidence

Why Previdian marks this CVE as exploited

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploited in the wild

Previdian

Recorded 10 Sep 2026

Previdian independently recorded this as exploited after first seeing it in honeypot sensors.

Active exploitation observed

Previdian sensor

First observed 10 Sep 2026

Previdian first observed exploitation attempts targeting this vulnerability in our honeypot sensors.

Proof of concept available

Nuclei Templates

Recorded 19 Aug 2026

Public scanner or PoC coverage increases practical exploitability.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the Previdian Pro API.

Learn about Pro API access

Source	Added
Previdian First	2026-09-10 06:31 UTC

Operational indicators for this CVE are listed under Detection.

Sensor telemetry

First-party evidence of exploitation activity

Previdian sensors recorded exploitation attempts targeting this vulnerability. The cards and chart show volume, unique attackers, and daily activity.

1

Attempts observed

1

Unique attacker IPs

1

Attacker countries

AU

1

Sensors observed

CVE-2026-71362 exploitation attempts over the last 12 days

Daily events observed by Previdian sensors

Updated 20 Sep 2026

0

1

0

9 Sep 12 Sep 15 Sep 20 Sep

First observed 10 Sep 2026 · Last observed 10 Sep 2026

Pro adds sensor region and window summaries. Enterprise adds raw IPs, paths, User-Agents, and payloads.

Request telemetry access

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Observed signals

Request targets
User-Agents
Callback hosts: 1; 1; 0

Request targets and User-Agents available in Pro. Callback host details available in Enterprise.

Scanner coverage

Nuclei template detected 19 Aug 2026.

View Nuclei template

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

Attacker IP Indicators

Attacker IP indicators observed · available in Pro and Enterprise.

Sensor-derived attacker IP indicators are available to Pro and Enterprise accounts under Detection and through the Pro API.

Learn about Pro API access

Scanner Artifacts

Scanner and exploit-framework references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-71362.yaml	19 Aug 2026

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

9.1 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

24.5%

Weaknesses

Incorrect Authorization CWE-863

Recent mention · BleepingComputer

12 Aug 2026

Hackers exploit critical Adobe Commerce flaw to hijack customer accounts

Attempts to exploit a critical vulnerability (CVE-2026-71362) in Adobe's Commerce and Magento e-commerce platforms have been detected, potentially allowing attackers to hijack customer accounts. [...]

Read full advisory

All Mentions

Recent mention · BleepingComputer

Hackers exploit critical Adobe Commerce flaw to hijack customer accounts

BleepingComputer · 12 Aug 2026

Attempts to exploit a critical vulnerability (CVE-2026-71362) in Adobe's Commerce and Magento e-commerce platforms have been detected, potentially allowing attackers to hijack customer accounts. [...]

Recent mention · Adobe Commerce Security Bulletins

APSB26-92 : Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Commerce Security Bulletins · 11 Aug 2026

CVE-2026-48414 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Exploit depends on conditions beyond the attacker's control. Scope is changed. CVE-2026-48416 Adobe Commerce | Incorrect...

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

Adobe Commerce/Magento - Customer Session Identity Switch

nuclei · Created Unknown

Timeline

From disclosure to observed exploitation

10 Sep 2026
05:27 UTC

Indicator of compromise added

Indicators of compromise recorded
10 Sep 2026
05:27 UTC

Observed by Previdian sensors

Evidence-backed exploitation signal
19 Aug 2026
04:30 UTC

Public PoC available

Public proof-of-concept code published
19 Aug 2026
04:30 UTC

Nuclei template available

Scanner coverage available
12 Aug 2026
00:00 UTC

Added to the Previdian watchlist

Pro and Enterprise Watch users had 4 weeks of early warning before Previdian confirmed it as a KEV.
11 Aug 2026
17:52 UTC

CVE published

Vulnerability disclosed publicly
05 Aug 2026
23:51 UTC

CVE ID reserved

Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro pricing Read API docs

Evidence confidence and provenance
First-party sensor telemetry
PoC and scanner references
Affected versions and enrichment
Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-71362

Free JSON includes basic KEV fields

{
  "cve_id": "CVE-2026-71362",
  "confidence": "Confirmed",
  "cvss_score": 9.1,
  "cvss_estimated": false,
  "epss_score": 0.2452,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": true
  },
  "sensor_telemetry": { "attempts": 1, "sensors": 1 }
}

CVE-2026-71362

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation

Tags

CVE References

Exploited in the wild

Active exploitation observed

Proof of concept available

Known exploited vulnerability sources

Observed signals

Scanner coverage

Virtual patch status

Attacker IP Indicators

Scanner Artifacts

Weaknesses

Hackers exploit critical Adobe Commerce flaw to hijack customer accounts

All Mentions

Potential Proof of Concepts

Indicator of compromise added

Observed by Previdian sensors

Public PoC available

Nuclei template available

Added to the Previdian watchlist

CVE published

CVE ID reserved

Automate this intelligence