CVE-2026-71362 — Unauthenticated privilege escalation in Adobe Commerce and Magento (explainer and fix)

Confirm the line and patch level of your store, then update to the 2026-aug release of that line and confirm the running version changed. If you run several environments — production, staging, an old spare storefront — everything reachable from the internet is in scope. The forgotten old store is the one least likely to be patched (security inventory checklist).

Lines older than 2.4.4 get no fix. Migration takes time, so meanwhile restrict who can reach the admin and API entry points and turn on WAF protections to shrink who can reach you. That reduces risk in the meantime but does not fix the flaw; only migration does.

If the store stayed unpatched at any point after 11 August, treat that window as suspect; CISA also lists this CVE as requiring forensic triage. At minimum: (1) Admin accounts — any you do not recognise, or changed permissions. (2) Integrations and API tokens — any you did not create, or recently issued tokens. (3) Files and configuration — especially scripts loaded on checkout and HTML or settings editable from the admin panel (in e-commerce compromises, planting a script that steals payment data is the typical goal). (4) Logs — access to admin or API functions from unusual sources, at unusual hours, or in unusual volume.

If you cannot rule out an intrusion, rotate admin passwords, integration tokens, and keys for payment and external APIs, and invalidate all sessions. A patch closes the flaw; it does not revoke credentials or keys that were already stolen. Fixing the flaw and removing an intruder are separate tasks. The full process is in the vulnerability remediation playbook.

As here, an update judged non-urgent at release can become urgent later. Get notified when something lands in KEV (this site's vulnerability alerts are one way), or apply security updates outside the regular update cycle.