CVE-2026-71362: Magento Authorization Flaw

How to Detect It

Detection should begin with asset and version inventory. Identify Adobe Commerce, Commerce B2B, and Magento Open Source installations, then compare exact package and release labels with the affected and fixed versions in APSB26-92. Pay particular attention to internet-facing stores, customer-account functionality, deployments with B2B modules, and systems that process or expose customer and payment-related data.

Review application and web logs for abnormal access to customer-account or session-management functionality. Useful indicators include a single authenticated session accessing multiple unrelated customer identifiers, rapid sequential requests for customer records, account activity inconsistent with the customer’s normal location or device, and requests that change an identity reference without a corresponding ownership check. These indicators are not proof of exploitation because exact endpoint names and log formats vary by deployment.

Technical Notes

If web logs contain request paths and authenticated customer identifiers, an initial search can be adapted as follows:

zgrep -Eai \\
  'customer|account|session|identity|token' \\
  /var/log/nginx/access.log* /var/log/apache2/access.log* |
  grep -Eai 'id=|customer_id|customerId|entity_id|session|token'

The pattern is intentionally broad and must be tuned to the application’s routes and structured logging fields. Combine it with a correlation rule that flags one session, account, or source address accessing multiple customer identifiers within a short period. For JSON logs, a SIEM query should group by session ID or authenticated account and count distinct customer IDs, for example:

where url matches /(customer|account|session)/i
| summarize distinct_customer_ids=dcount(customer_id),
            request_count=count()
  by session_id, bin(timestamp, 10m)
| where distinct_customer_ids > 1

This query is a detection starting point, not a vendor-specific signature. If customer IDs are not logged, enable privacy-conscious server-side audit logging before attempting retrospective analysis. Preserve relevant logs, session metadata, and database access records for incident response.

Mitigation and Patching

Upgrade each affected deployment to the corresponding August 2026 security release listed in Adobe APSB26-92. Confirm the exact product, branch, cloud or on-premises deployment model, and enabled Commerce B2B modules before changing packages. For Adobe Commerce, the supplied fixed labels include 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, and 2.4.4-2026-aug, as applicable.

For Composer-managed installations, use the version and repository instructions supplied by Adobe rather than copying a generic package command into production. A controlled upgrade commonly begins with version verification and dependency inspection:

bin/magento --version
composer show magento/product-community-edition 2>/dev/null || true
composer show magento/product-enterprise-edition 2>/dev/null || true
composer validate

After selecting the approved fixed package from APSB26-92 and testing it in staging, execute the organization’s standard deployment workflow, followed by cache and application checks. Do not infer the correct Magento Open Source package string from the Adobe Commerce examples; confirm the exact fixed release in the bulletin.

During an emergency remediation, teams should also verify that privileged credentials are stored and shared through an approved password-management process. An enterprise password manager such as 1Password can help centralize access controls, but it does not replace patching, session invalidation, or incident investigation.

Technical Notes

If immediate patching is impossible, restrict exposure to trusted networks, place the storefront behind a tightly controlled application gateway, and disable affected customer-facing functionality only if Adobe’s instructions support that action. Do not assume that a web application firewall rule is a complete fix for an authorization flaw unless Adobe provides a specific rule or workaround.

Invalidate active customer sessions after remediation where compromise cannot be ruled out. Review account and customer-record access, preserve evidence, and consider credential or token rotation based on the data exposed in the affected environment. Because exploitation is confirmed, temporary network restrictions should be treated as risk reduction while patching, not as a permanent substitute for the fixed release.

Incident Response Priorities

Organizations that identify an affected and internet-facing store should prioritize the following actions:

1. Confirm the exact product and package versions.
2. Restrict unnecessary exposure while preparing the upgrade.
3. Preserve web, application, authentication, and database-access logs.
4. Search for sessions or accounts accessing multiple customer identifiers.
5. Upgrade to the applicable fixed release in APSB26-92.
6. Invalidate active customer sessions if unauthorized access cannot be excluded.
7. Review affected customer records and notify appropriate stakeholders according to legal and organizational requirements.

Use synthetic records and an isolated environment for any authorized reproduction or validation. Avoid attempting proof-of-concept testing against production or customer data.

References

Adobe’s primary security bulletin is APSB26-92, which provides the authoritative product-specific remediation guidance and fixed versions: Adobe APSB26-92. Adobe’s canonical advisory page is also available at Adobe Commerce APSB26-92.

The vulnerability record is available from the NVD entry for CVE-2026-71362. CISA’s exploitation status is represented in the Known Exploited Vulnerabilities Catalog.

The reported public lab and proof of concept are available at GitHub: cve-2026-71362-magento-lab. Use it only for authorized research in an isolated environment, and verify all behavior against Adobe’s official advisory and the exact software version under assessment.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.