Magento Has a Critical Account Takeover Bug. Attackers Are Already Trying It
- The Mess: Adobe patched CVE-2026-71362, a critical vulnerability in Adobe Commerce and Magento Open Source that can allow unauthenticated attackers to manipulate customer sessions and potentially take over accounts. Exploitation attempts were observed shortly after disclosure.
- The Damage: The flaw can be triggered remotely without credentials or user interaction, putting online stores and customer accounts at risk. Attackers targeting vulnerable shops can potentially bypass normal authentication controls and access accounts they don’t own.
- The Fix: Upgrade affected Adobe Commerce and Magento Open Source installations to the patched releases and review authentication and session logs for suspicious activity.
Magento stores have a particularly unpleasant security property.
They are supposed to trust the browser just enough to sell something.
CVE-2026-71362 abuses that trust.
And attackers didn’t wait long after the vulnerability became public.
The Bug Lives in Session Handling
The vulnerability affects Magento’s handling of customer authentication and session information.
An unauthenticated attacker can send specially crafted requests that manipulate how the application processes authentication state.
The result can be account takeover without knowing the victim’s password.
That makes this much more serious than a conventional storefront bug.
A compromised product page is annoying.
A compromised administrator account is catastrophic.
A compromised customer account can expose personal information, order history, addresses and other sensitive data.
No Login Required
The CVSS vector is particularly ugly:
AV:N/AC:L/PR:N/UI:N
The attacker operates remotely.
Attack complexity is low.
No privileges are required.
The victim doesn’t have to click anything.
That’s exactly the combination defenders don’t want to see in an Internet-facing e-commerce application.
And Magento installations are often directly exposed to the public Internet by design.
The storefront isn’t hidden behind a VPN.
It’s the front door.
Attackers Moved Quickly
Sansec reported exploitation attempts shortly after the vulnerability was disclosed.
The timing matters because Magento attacks are already heavily automated.
Attackers routinely scan Internet-facing stores looking for vulnerable versions, exposed administration panels and weak configurations.
Once a reliable exploit becomes available, the vulnerable store becomes another automated target.
There is no need for a sophisticated intrusion campaign.
A bot can do the first part.
The Customer Is Not the Only Target
The obvious concern is customer accounts.
But the bigger prize may be an administrator account.
Magento administrators have access to the store backend, orders, customer information, catalog management and configuration.
If an attacker can turn a customer-facing vulnerability into privileged access, the consequences change completely.
The attacker may not need to steal individual accounts.
They may be able to compromise the store itself.
That’s the scenario defenders should be investigating.
Check More Than the Version
Patching is the first step.
It isn’t the last.
Administrators should review:
- unexpected account logins
- newly created administrator accounts
- unusual password-reset activity
- suspicious session changes
- unexpected configuration modifications
- unfamiliar extensions or modified PHP files
A vulnerable Magento server that was Internet-facing during the exploitation window deserves investigation even after it has been patched.
The patch stops the next attack.
It doesn’t erase the previous one.
Magento Is a High-Value Target
E-commerce platforms contain exactly the kind of data attackers like.
Names.
Addresses.
Email accounts.
Phone numbers.
Order histories.
Payment-related information.
And, depending on the compromise, administrative credentials and application secrets.
That’s why a vulnerability that starts as “account takeover” shouldn’t be dismissed as a customer-support problem.
It can become an infrastructure problem very quickly.
Bugstoday Opinion
Magento vulnerabilities are rarely interesting because of the CVSS number alone.
They’re interesting because the vulnerable system is usually the business.
Take down the storefront and revenue stops.
Compromise customer accounts and trust disappears.
Compromise the backend and the attacker may own the entire operation.
CVE-2026-71362 is exactly the sort of vulnerability attackers can turn into an automated campaign once exploitation becomes reliable.
Bugstoday verdict: if your Magento installation is exposed to the Internet, don’t wait for evidence that someone attacked it. Patch it, then check whether someone already did.
Today’s Bugs. Tomorrow’s Breaches.
