Loading story…
Adobe issued security updates for multiple vulnerabilities in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source, including CVE-2026-71362, which open-source reporting indicates is being actively exploited in the wild. The broader advisory also covers Adobe Campaign Classic, ColdFusion, Content Credentials tools and SDKs, and Lightroom Classic.
The Commerce flaws are remotely exploitable and may enable arbitrary code execution, malicious script injection into web forms, disclosure of sensitive information, security-control bypasses, privileged access to restricted files, and temporary denial of service. NCSC Netherlands, Guyana CIRT, and bjCSIRT urged administrators to apply Adobe's updates immediately; NCSC reported no known public proof-of-concept or exploit code for the vulnerabilities it described.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-75650 was published as a critical remotely exploitable Adobe Commerce B2B vulnerability. Its CVSS v3 vector indicates network exploitation requiring no privileges or user interaction, with high confidentiality, integrity, and availability impact and changed scope; Adobe published an associated patch on September 7, 2026.
Open-source reporting cited in the Adobe advisory coverage indicated that CVE-2026-71362 was being exploited in the wild.
The Canadian Centre for Cyber Security published its Adobe security advisory, identified as AV26-808.
Adobe published a security advisory addressing vulnerabilities affecting Adobe Commerce, Magento Open Source, ColdFusion, Campaign Classic, Lightroom Classic, and Content Credentials tools and SDKs. The advisory identified affected versions through August 2026 and provided updates for affected products, including Adobe Commerce.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
csirt.bj
Open sourcetenable.com
Open sourcencsc.nl
Open sourcecirt.gy
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe Commerce and Magento Community Edition deployments are exposed to **CVE-2025-54236**, a critical improper-input-validation flaw (CWE-20) that allows a remote, unauthenticated attacker to take over user sessions without interaction. Public exploit code, including the Metasploit `Magento SessionReaper` module, is available, increasing the risk of account compromise, unauthorized access to customer and business data, and malicious activity in affected online stores. Adobe released fixes for the vulnerability, and the Dutch National Cyber Security Centre urged organizations to apply the updates immediately and have providers confirm whether their installations are affected. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog; organizations should prioritize patching affected Adobe Commerce and Magento packages, validate remediation, and review sessions and store activity for signs of compromise.
Sep 3, 2026
Attackers have begun targeting **CVE-2026-71362**, a critical incorrect-authorization flaw in **Adobe Commerce**, **Adobe Commerce B2B**, and **Magento Open Source** that can let unauthenticated users hijack customer accounts. Sansec reported seeing exploitation attempts blocked by its Shield WAF and said patch analysis showed Magento mishandles customer identity within an account session, allowing a session to be switched to another customer account and exposing private customer data. Adobe included fixes for CVE-2026-71362 in its August 2026 security updates, with affected versions spanning multiple July 2026 and some August 2026 release lines before newer August builds. The same update also addressed **CVE-2026-48413**, a stored **XSS** issue, along with six additional Commerce and Commerce B2B vulnerabilities, four rated high severity. Administrators were urged to move to the latest supported `-p` release and apply Adobe’s isolated patches promptly to reduce the risk of account takeover and data exposure.
Aug 28, 2026
Adobe released security updates for multiple critical vulnerabilities affecting **Adobe FrameMaker Publishing Server**, **Adobe Commerce**, **Magento Open Source**, and the **Adobe Commerce Webhooks** extension. The most serious issues include `CVE-2024-30299` and `CVE-2024-30300` in FrameMaker Publishing Server and `CVE-2024-34102` in Adobe Commerce and Magento, with severity reaching **CVSS 10.0**. Successful exploitation could allow **arbitrary code execution**, **security feature bypass**, and **privilege escalation**. Adobe also issued critical fixes for **Adobe Experience Manager**, **Creative Cloud Desktop**, **Photoshop**, and **Substance 3D Stager** to address vulnerabilities that could enable code execution, unauthorized system access, and exposure of sensitive data. National cybersecurity authorities highlighted the breadth and severity of the flaws and urged organizations using affected Adobe products to apply vendor patches immediately in line with Adobe guidance.
Jun 29, 2026