What happened

Attackers are already exploiting a critical vulnerability in Adobe Commerce and Magento Open Source — just days after the patch dropped. Tracked as CVE-2026-71362 and rated CVSS 9.1, the flaw lets an unauthenticated attacker switch a customer session to another customer’s account — no login, no admin access, no user interaction required.

E-commerce security firm Sansec confirmed it’s already blocking exploitation attempts through its web application firewall. Adobe released the fix in its August 2026 security update (APSB26-92), but stated it was not aware of in-the-wild exploitation at the time of release. The attacks started almost immediately after.

Who’s affected

Any business running Adobe Commerce, Commerce B2B, or Magento Open Source on versions prior to the August 2026 patch. That includes a lot of Australian hospitality and retail operators who use Magento for online ordering, bookings, and gift cards. If your e-commerce platform stores customer payment details, delivery addresses, or loyalty data, this is the one to act on today.

We see Magento installs across our hospitality and not-for-profit client base here in Sydney and the Central West — and in our experience, these platforms are often a generation behind on patches because “the site’s working fine” feels like a good enough reason to leave it alone. It’s not.

What to do

Apply the August 2026 isolated patch for your supported Commerce or Magento release branch now. These aren’t delivered as full Composer packages — they’re standalone patch files. Make sure you’re on the latest -p release for your branch first, then apply the corresponding patch.

If you can’t patch immediately, talk to your hosting provider about enabling a WAF rule to block the exploit pattern while you schedule the update.

Need a hand?

If you’re not sure whether your Magento or Commerce install is patched, or you want someone to handle the update, get in touch with our team. We also offer ongoing managed IT support that includes patch management so you don’t have to keep track of these yourself.