Hackers exploit critical Adobe Commerce flaw to hijack customer accounts

A critical incorrect authorization flaw (CVE-2026-71362) in Adobe Commerce and Magento is being actively exploited, allowing attackers to hijack customer accounts and access private data without any authentication. The vulnerability represents a fundamental breakdown in access control logic, where the platform fails to properly verify user identity before granting access to sensitive resources. The fact that exploitation was detected so quickly after disclosure highlights the narrow window organizations have to patch internet-facing e-commerce systems. This matters enormously for merchants because compromised customer accounts can lead to payment fraud, data breaches, and significant regulatory penalties under frameworks like GDPR and PCI-DSS.