Adobe patches critical Magento account takeover (APSB26-92)

Adobe has released isolated security patches for APSB26-92 for Adobe Commerce and Magento Open Source.

The update fixes seven vulnerabilities. Five are rated Critical, including CVE-2026-71362, an unauthenticated customer account takeover with a CVSS score of 9.1. Exploitation needs no existing account, administrator privileges or user interaction.

Customer account takeover

Sansec reviewed the patch and confirmed that the vulnerability lets attackers switch a customer session to another customer account. This gives them access to the victim's account and private customer data.

Adobe fixed the way Magento handles customer identity in the account session. The other vulnerabilities cover stored cross-site scripting and authorization flaws.

No separate security release

APSB26-92 does not come with a new security release or new Composer packages. Under Adobe's current patch schedule, monthly fixes are distributed as isolated patch files and later included in a full security patch.

Merchants must run the latest -p release for their supported release line before applying the corresponding isolated patch.

Sansec Shield protection

Running Sansec Shield? You are already protected against this customer account takeover. Shield blocks attacks before they reach Magento, even when a security patch has not been installed yet.

Read more

• Amasty patches dozens of Magento extensions, 2 critical
• Unauthenticated file upload in Amasty Order Attributes for Magento
• Critical vulnerability in Mirasvit Cache Warmer for Magento
• Adobe patches critical Magento admin takeover via menu injection
• Magento Security Release APSB25-08 [Impact Analysis]