Imagine walking up to a checkout counter, and just by standing in the right spot, the cashier hands you someone else's credit card, order history, and saved address — no ID required. That's essentially what just happened to every unpatched Adobe Commerce and Magento store on the internet, courtesy of a busted authorization check.

The Bug That Skips the "Who Are You?" Part

CVE-2026-71362, a critical incorrect-authorization flaw with a 9.1 CVSS score, lets an attacker hijack an active shopping session and swap it for someone else's customer account — no login, no admin access, and no click required from the victim. Security firm Sansec, which reverse-engineered Adobe's patch to figure out what broke, says exploitation attempts began almost immediately after the August 2026 security update went out.

Adobe bundled the fix into a seven-vulnerability patch release covering Commerce and Magento Open Source lines 2.4.4 through 2.4.9 (plus Commerce B2B), with four more bugs rated high severity. Sansec's firewall is already blocking live exploitation attempts, so this isn't a theoretical worst case — it's just Tuesday on the internet.

Why Your Checkout Page Just Became a Liability

Account takeover on an e-commerce platform isn't just embarrassing — it's a direct line to stored payment methods, order history, and loyalty balances, handed over because a session token didn't check its ID at the door. And since exploitation requires zero user interaction, "tell customers to use strong passwords" does exactly nothing to stop it.

The uncomfortable pattern here is one we keep seeing: attackers now routinely reverse-engineer official patches faster than store owners apply them, turning every disclosure into a countdown timer. If your Magento instance is still running last month's build, the clock isn't just ticking — it may have already gone off.

Patch first, ask questions later — preferably questions like "wait, how long were we exposed?"

If "am I actually patched, and what else is lurking in my stack" is a question you'd rather answer before an attacker does, our developer security checklist is built for exactly this kind of Tuesday.

Source: BleepingComputer