The Adobe Commerce Flaw Hackers Are Using to Steal Customer Accounts Right Now

Robert Moore · 2026-08-12

If you run an online store on Adobe Commerce or Magento, you might want to sit down for this one. Security researchers have spotted active attempts to exploit a critical vulnerability tracked as CVE-2026-71362. In plain English, that means attackers are actively trying to break into customer accounts on stores that haven't patched yet. And the scary part? Some of these attempts are already succeeding. The flaw sits right in the heart of Adobe's e-commerce platforms, which power thousands of online stores across the United States. When exploited, it can let an attacker hijack a customer account without needing their password. Think about what that means for your shoppers: their saved addresses, order history, and payment details could all be exposed. For you, it could mean a massive hit to your reputation and a potential flood of chargebacks. ### What Exactly Is CVE-2026-71362? This isn't just another routine bug. Adobe has labeled it as critical, which is the highest severity rating they can assign. The vulnerability stems from a flaw in how the platform handles authentication tokens. In technical terms, it allows for improper access control. But let's translate that into something we can all understand. Imagine you hand someone a key to your house, but that key also happens to open every house on your street. That's essentially what this flaw does. It lets an attacker bypass normal login checks and slip into a user's session. Once they're in, they can change the account email, reset the password, and lock the real owner out completely. Security firm Adobe has already released a patch, but here's the catch: many store owners haven't applied it yet. The window of opportunity for hackers is wide open on unpatched systems. If you haven't updated your Adobe Commerce or Magento installation in the last few weeks, you need to stop reading and check your admin panel right now. ### The Real-World Impact on Your Store Let's talk about what this actually looks like when it goes wrong. A hacker doesn't just steal an account for fun. They typically use it to make fraudulent purchases, drain stored gift cards, or harvest personal data for identity theft. In the United States alone, e-commerce fraud is expected to cost businesses billions of dollars this year, and vulnerabilities like this are a major entry point. Here's what you should be watching for in your store's logs: - Unusual login patterns, like multiple logins from different states within minutes - Customers reporting that their email address was changed without their knowledge - Orders placed to addresses that don't match the customer's normal shipping info - A sudden spike in password reset requests from a single IP range If you see any of these signs, don't ignore them. Act fast. Lock down affected accounts, force password resets, and review any recent changes to account details. ### What You Can Do Right Now I know this sounds alarming, but there's a clear path forward. The first step is obvious: apply the latest security patch from Adobe. If you're on a managed hosting plan, your provider may have already done this for you. Check with them to confirm. If you're running the platform yourself, log into your admin dashboard and look for available updates. Beyond patching, you should enable two-factor authentication for all admin accounts. That adds an extra layer of protection even if someone figures out a password. Also, consider using a web application firewall that can block known exploit attempts. Many security services have already updated their rules to catch attacks targeting CVE-2026-71362. Finally, talk to your customers. If you suspect any breach, be transparent. Send an email letting them know you're aware of the issue and that you've taken steps to protect their data. Trust is hard to build and easy to lose, so honesty goes a long way. ### The Bottom Line This vulnerability is a wake-up call for anyone running an online store. Hackers are not waiting around, and neither should you. Patch your systems, monitor your logs, and keep your guard up. The cost of inaction is far higher than the few minutes it takes to secure your platform. Your customers are counting on you to keep their data safe, so make sure you're doing everything in your power to do just that.