{"cve":{"cve_id":"CVE-2026-71362","is_kev":false,"kev_date_added":null,"kev_vendor_project":null,"kev_product":null,"kev_vulnerability_name":null,"kev_short_description":null,"kev_required_action":null,"kev_due_date":null,"kev_known_ransomware":null,"kev_notes":null,"kev_cwes":null,"epss_score":0.25136,"epss_percentile":0.97767,"epss_as_of":"2026-08-26","description":"Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.","published_at":"2026-08-11T17:52:48.311000Z","last_modified_at":"2026-08-12T21:03:43.743000Z","cvss_v3_score":9.1,"cvss_v3_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_v3_severity":"CRITICAL","cvss_v4_score":null,"cvss_v4_vector":null,"cvss_v4_severity":null,"ssvc_decision":null,"ssvc_exploitation":"none","ssvc_automatable":true,"ssvc_technical_impact":"total","cwes":["CWE-863"],"nvd_references":["https://helpx.adobe.com/security/products/magento/apsb26-92.html"],"vuln_status":"Undergoing Analysis","trending_score":null,"is_trending":false,"has_trended":false,"trended_number_one":false,"trending_peak_score":null,"trending_peak_rank":null,"started_trending_at":null,"trended_number_one_at":null,"summary_generated":null,"summary_generated_at":null,"summary_model":null,"created_at":"2026-08-11T20:20:52.861310Z","updated_at":"2026-08-14T18:36:47.718905Z"},"effective_severity":"CRITICAL","badges":["poc","news"],"impact_analysis":[],"cvss_v3_decoded":{"version":"3.1","metrics":[{"metric":"AV","name":"Attack Vector","value":"N","value_label":"Network"},{"metric":"AC","name":"Attack Complexity","value":"L","value_label":"Low"},{"metric":"PR","name":"Privileges Required","value":"N","value_label":"None"},{"metric":"UI","name":"User Interaction","value":"N","value_label":"None"},{"metric":"S","name":"Scope","value":"U","value_label":"Unchanged"},{"metric":"C","name":"Confidentiality","value":"H","value_label":"High"},{"metric":"I","name":"Integrity","value":"H","value_label":"High"},{"metric":"A","name":"Availability","value":"N","value_label":"None"}]},"cvss_v4_decoded":{"version":null,"metrics":[]},"affected":[{"vendor_slug":"adobe","vendor_name":"Adobe","product_slug":"adobe-commerce","product_name":"Adobe Commerce","version_start":"0","version_start_inclusive":true,"version_end":"2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug","version_end_inclusive":true,"cpe23_uri":"cve5:adobe:adobe-commerce:0:2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug"},{"vendor_slug":"adobe","vendor_name":"Adobe","product_slug":"adobe-commerce","product_name":"Adobe Commerce","version_start":"2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug","version_start_inclusive":true,"version_end":"2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug","version_end_inclusive":true,"cpe23_uri":"cve5:adobe:adobe-commerce:2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug:2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug"},{"vendor_slug":"adobe","vendor_name":"Adobe","product_slug":"adobe-commerce-b2b","product_name":"Adobe Commerce B2B","version_start":"0","version_start_inclusive":true,"version_end":"1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul","version_end_inclusive":true,"cpe23_uri":"cve5:adobe:adobe-commerce-b2b:0:1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul"},{"vendor_slug":"adobe","vendor_name":"Adobe","product_slug":"adobe-commerce-b2b","product_name":"Adobe Commerce B2B","version_start":"1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug","version_start_inclusive":true,"version_end":"1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug","version_end_inclusive":true,"cpe23_uri":"cve5:adobe:adobe-commerce-b2b:1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug:1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug"},{"vendor_slug":"adobe","vendor_name":"Adobe","product_slug":"magento-open-source","product_name":"Magento Open Source","version_start":"0","version_start_inclusive":true,"version_end":"2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul","version_end_inclusive":true,"cpe23_uri":"cve5:adobe:magento-open-source:0:2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul"},{"vendor_slug":"adobe","vendor_name":"Adobe","product_slug":"magento-open-source","product_name":"Magento Open Source","version_start":"2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug","version_start_inclusive":true,"version_end":"2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug","version_end_inclusive":true,"cpe23_uri":"cve5:adobe:magento-open-source:2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug:2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug"}],"exploit_refs":[{"source":"nuclei","kind":"nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-71362.yaml","title":"Adobe Commerce/Magento - Customer Session Identity Switch","author":"0x_Akoko,dinosn","disclosed_at":null}],"news":[{"id":1169,"source":"BleepingComputer","url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-adobe-commerce-flaw-to-hijack-customer-accounts/","title":"Hackers exploit critical Adobe Commerce flaw to hijack customer accounts","summary":"Attempts to exploit a critical vulnerability (CVE-2026-71362) in Adobe's Commerce and Magento e-commerce platforms have been detected, potentially allowing attackers to hijack customer accounts. [...]","thumbnail_url":null,"author":"Bill Toulas","published_at":"2026-08-12T20:54:59Z","fetched_at":"2026-08-12T21:03:53.016595Z","trending_score":0.008238370159325296,"cve_ids":["CVE-2026-71362"]}],"references":[{"url":"https://helpx.adobe.com/security/products/magento/apsb26-92.html","source_type":"VENDOR_ADVISORY","tags":["advisory"]}],"timeline":[{"type":"published","at":"2026-08-11T17:52:48.311000Z","label":"CVE published","source":null},{"type":"ssvc_changed","at":"2026-08-12T15:21:52.865925Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"ssvc_changed","at":"2026-08-12T15:21:52.865925Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"ssvc_changed","at":"2026-08-12T15:21:52.865925Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"first_article","at":"2026-08-12T20:54:59Z","label":"First news coverage","source":"BleepingComputer"},{"type":"poc_available","at":"2026-08-18T16:41:27.546054Z","label":"Public PoC available","source":"nuclei"}]}