Sansec detects attempts to exploit critical Adobe Commerce account-takeover flaw
Founder Willem de Groot's security shop says its WAF is blocking attempts, while Adobe says it has no confirmed in-the-wild exploits.
By RuntimeWire Staff · Published
Primary source: BleepingComputer
Why it matters
Sansec's telemetry suggests attackers are testing a no-login account-takeover path while merchants face a multi-step patch process. Shield may block the request pattern Sansec identified, but Adobe's update is the durable fix.
Willem de Groot, founder of e-commerce security specialist Sansec, says its Shield web application firewall is blocking attempts to exploit a critical Adobe Commerce and Magento Open Source vulnerability that can expose customer accounts without a login.
The finding puts de Groot's narrow bet on Magento security into practice one day after Adobe published its August 11 security bulletin. Sansec, which de Groot founded, analyzed Adobe's patch and identified a weakness in how Magento associates a customer's identity with an active account session.
Sansec says an attacker can exploit CVE-2026-71362 to switch that session to another customer, gaining access to the victim's account and private data. The attack requires no existing account, administrator privileges or customer interaction, according to Sansec's technical report.
Adobe assigned the incorrect-authorization flaw a 9.1 CVSS score and classified it as critical.
The evidence stops short of a confirmed account-takeover campaign. BleepingComputer reported that Sansec said its Shield web application firewall was already blocking CVE-2026-71362 exploitation attempts. Adobe says it is unaware of exploitation in the wild for any of the vulnerabilities covered by the update.
Sansec may be seeing probes that its controls reject before an account is compromised, while Adobe may require stronger evidence before classifying a vulnerability as exploited in the wild. Merchants should read Sansec's telemetry as evidence that someone is testing the flaw against live infrastructure, rather than proof that customer accounts have already been hijacked.
De Groot built Sansec for the patching gap
De Groot has centered Sansec on the delay between a vulnerability's discovery and a merchant's ability to test and deploy a fix. That delay is especially consequential for self-hosted commerce software, where an emergency update can collide with customized checkout code, extensions and payment integrations.
Your.Online announced in May 2026 that Sansec had joined its portfolio while retaining independent technical leadership. Financial terms were not disclosed.
CVE-2026-71362 puts Sansec's defenses to a direct test: Sansec says Shield customers were protected after Adobe released the patch.
Sansec publishes Shield's source code on GitHub. Sansec markets its Magento-focused approach against generic web application firewalls, arguing that knowledge of Magento requests helps it identify malicious session manipulation.
The product has clear boundaries. Sansec says Shield covers attacks arriving through web traffic, while stolen credentials, compromised SSH accounts, infected administrator devices and weaknesses in unrelated applications require separate controls. Blocking CVE-2026-71362 therefore addresses one route into a store. It does not establish that an Adobe Commerce installation is secure across its wider infrastructure.
Sansec also sells the product whose telemetry supports its exploitation claim. That commercial incentive does not invalidate the finding; it makes precision important. Sansec's public claim rests on requests Shield rejected, while Adobe says it is unaware of exploitation in the wild.
Adobe's patch requires more than one download
CVE-2026-71362 is one of seven vulnerabilities in Adobe's APSB26-92 bulletin. Adobe rates the central flaw critical; the update also covers four high-severity, one medium-severity and one low-severity issue. The group includes stored cross-site scripting flaws that can lead to arbitrary code execution and additional authorization weaknesses that can bypass security features or escalate privileges.
Adobe published APSB26-92 on August 11, 2026. The bulletin covers supported Adobe Commerce, Adobe Commerce B2B and Magento Open Source release lines, with version-specific security-only releases and isolated patches listed in its solution table.
Adobe's installation guidance says merchants must first be on the latest security-only -p release for their supported branch. Adobe's security-patch documentation says isolated patches are non-cumulative and require that latest security-only release before installation.
The patch sequence creates the same operational opening de Groot built Sansec to cover. Large merchants cannot always move an update directly from publication into production, yet a critical unauthenticated flaw leaves little room for a normal release calendar. Shield can buy time against the request pattern Sansec has identified. Adobe's patch remains the durable fix.
The episode gives de Groot a clear product test and leaves merchants with a short patching window. Operators need to identify the exact Commerce branch and installed components, move to the latest security-only release, apply the relevant isolated patch, verify the result and monitor account activity for signs that a session was reassigned before remediation.