What Happened
Adobe’s August 2026 security update, APSB26-92, patched CVE-2026-71362, a CVSS 9.1 unauthenticated account takeover vulnerability in Adobe Commerce and Magento Open Source. The flaw stems from improper handling of customer identity within a session, allowing an attacker to switch an active session into another shopper’s account without credentials, admin access, or user interaction. Versions 2.4.4 through 2.4.9 running the July 2026 security-update build or earlier are affected.
Security firm Sansec observed exploitation attempts against the flaw within hours of Adobe releasing the patch, indicating attackers reverse-engineered the fix to build a working exploit almost immediately. Sansec’s Shield web application firewall is blocking observed attempts, though stores without the patch or equivalent protection remain exposed to unauthenticated account takeover.
Why This Matters for Canadian Organizations
Adobe Commerce and Magento power a large share of mid-size and enterprise online retail in Canada, from independent e-commerce brands to national chains running Magento-based storefronts. Account takeover at this scale means an attacker views order history, saved addresses, stored payment tokens, and other personal information belonging to Canadian shoppers without needing a password. Under PIPEDA, unauthorized access to customer personal information of this kind typically triggers breach notification obligations when the incident creates a real risk of significant harm — a threshold this flaw meets given the sensitivity of the exposed data.
Retailers holding payment card data face added exposure, since account takeover on this scale feeds follow-on fraud, loyalty-point theft, and card-testing campaigns against the exposed accounts. Fast patching matters more here than usual — Sansec’s telemetry shows exploitation activity started before most site operators had a chance to apply the fix.
What to Do
Update Adobe Commerce and Magento Open Source to the August 2026 security release without delay, or apply Adobe’s isolated patch if a full upgrade isn’t immediately possible. Confirm the store runs a supported release branch before patching, since older branches require additional steps. Review recent order and account activity for signs of session anomalies, and consider forcing a password reset and session invalidation across the customer base as a precaution. Technical analysis is available from Sansec, with coverage from BleepingComputer.
