Attackers are actively exploiting a critical vulnerability tracked as CVE-2026-71362 in Adobe Commerce and Magento Open Source — the platforms that power a significant share of the internet's storefronts — to hijack customer accounts. Exploitation attempts have already been observed in the wild, meaning this is not a theoretical risk; if your storefront is unpatched and internet-facing, assume it is being probed right now.
Account takeover on an e-commerce platform is not a low-grade nuisance. Once an attacker controls a legitimate customer session or account, they inherit saved payment tokens, stored addresses, order history, and — critically — the trust of your fraud controls. We've seen this playbook before in IR engagements: mass account compromise leads to fraudulent purchases, gift card draining, credential-stuffing pivot attempts against other services, and eventually a notification obligation under state breach laws and, for merchants, PCI-DSS scrutiny. The blast radius extends well beyond the web server.
This post breaks down what we know, how the attack surface behaves, and — most importantly — how to detect exploitation and remediate before your customer database becomes someone else's credential list.
Technical Analysis
Affected Products
- Adobe Commerce (cloud and on-premises deployments running unpatched versions)
- Magento Open Source (unpatched versions)
Magento/Adobe Commerce runs on a LAMP/LEMP-style stack: PHP application code served via nginx or Apache, backed by MySQL/MariaDB and typically fronted by a CDN or WAF. The application layer — not the OS — is the attack surface here, which has important implications for where your detection telemetry needs to live.
The Vulnerability: CVE-2026-71362
Based on reporting on the active campaign, CVE-2026-71362 allows a remote attacker to hijack customer accounts — in practical terms, an authentication/session-handling flaw in the Commerce customer account workflow that lets an unauthenticated or low-privilege attacker assume control of a victim's session or account without valid credentials. Attack chains for this class of flaw in commerce platforms typically follow one of these patterns:
- Session or token prediction/forgery — the attacker crafts or manipulates a session identifier or token accepted by the storefront's customer session layer.
- Account-recovery abuse — the password-reset or account-recovery endpoint is manipulated to issue a valid reset token for an arbitrary account.
- Authorization bypass on customer endpoints — direct requests to customer/account API or GraphQL endpoints return or modify another customer's data (classic IDOR-style behavior at scale).
Regardless of the precise primitive, the observable behavior is consistent: an unusual volume of requests to customer account, login, password-reset, or GraphQL customer endpoints — often from rotating IPs — followed by successful account access and profile/payment changes.
Exploitation Status
- Status: Confirmed active exploitation attempts in the wild (per reporting)
- Public PoC: Exploitation attempts detected; defenders should treat working exploit logic as circulating
- Severity: Critical (authentication-impacting flaw on internet-facing infrastructure)
- CISA KEV: Check the CISA Known Exploited Vulnerabilities catalog — if added, federal civilian agencies face a binding remediation deadline, and it is a strong prioritization signal for everyone else
Why This Is Dangerous at Scale
Magento's market share makes it a mass-scanning target within hours of exploit availability. Historically, Magento-critical vulnerabilities (the Shoplift-era bugs and their successors) were weaponized into automated campaigns within days. Expect: (1) broad internet scanning for vulnerable storefronts, (2) automated account-enumeration and takeover scripts, and (3) follow-on Magecart-style skimmer injection if attackers pivot from customer accounts to admin panels.
Detection & Response
The single most valuable telemetry source for this threat is your web access log (nginx/Apache) and, if deployed, your WAF/CDN logs (Cloudflare, Akamai, Fastly, AWS WAF). Host-based detections catch the post-exploitation phase: web shells, injected skimmers, and PHP processes spawning shells.
Sigma Rules
---
title: Suspicious Burst of Requests to Adobe Commerce Customer Account Endpoints
id: 3f9c1a72-8b4e-4d2a-9c51-7e2f5a6b8d90
status: experimental
description: Detects high-volume requests to Magento/Adobe Commerce customer login, password reset, or account endpoints from a single source, consistent with CVE-2026-71362 account-hijacking exploitation or account enumeration.
references:
- https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-adobe-commerce-flaw-to-hijack-customer-accounts/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains:
- '/customer/account/login'
- '/customer/account/forgotpassword'
- '/customer/account/resetpassword'
- '/customer/account/create'
- '/rest/V1/customers'
- '/graphql'
condition: selection
falsepositives:
- Legitimate flash-sale traffic and marketing campaigns driving login volume
- Load balancer health checks hitting login pages
level: high
---
title: PHP-FPM or Web Server Process Spawning Shell on Magento Host
id: 8d2e5b41-3a7c-4f19-b6e2-1c9a4d7f5e83
status: experimental
description: Detects php-fpm, nginx, or apache spawning shell interpreters or command execution tools on a Magento/Adobe Commerce server, indicating post-exploitation web shell activity following CVE-2026-71362 exploitation.
references:
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.execution
- attack.t1059.004
- attack.t1505.003
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- '/php-fpm'
- '/php'
- '/nginx'
- '/apache2'
- '/httpd'
selection_child:
Image|endswith:
- '/sh'
- '/bash'
- '/dash'
- '/zsh'
- '/curl'
- '/wget'
- '/python'
- '/python3'
- '/perl'
- '/nc'
- '/ncat'
condition: selection_parent and selection_child
falsepositives:
- Magento cron jobs invoking shell scripts (verify against known cron paths)
- Legitimate deployment pipelines executing composer or setup scripts
level: critical
---
title: Magento Core or Pub Directory PHP File Modified Outside Deployment Window
id: 5c1f8a36-2d94-4b78-a3c5-9e7b2f4d6a18
status: experimental
description: Detects creation or modification of PHP files in Magento web root directories outside expected deployment tooling, consistent with web shell or Magecart-style skimmer injection following account/admin compromise.
references:
- https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.persistence
- attack.t1505.003
logsource:
category: file_event
product: linux
detection:
selection_path:
TargetFilename|contains:
- '/pub/'
- '/app/code/'
- '/var/www/html/'
selection_ext:
TargetFilename|endswith:
- '.php'
- '.phtml'
filter_deploy_user:
User|contains:
- 'deploy'
- 'jenkins'
- 'github'
- 'gitlab'
condition: selection_path and selection_ext and not filter_deploy_user
falsepositives:
- Manual hotfixes applied by developers outside CI/CD
- Extension manager (Web Setup Wizard) writes
level: high
KQL Hunt (Microsoft Sentinel)
This query assumes your storefront access logs (nginx/Apache/ELB/Cloudflare) are ingested into Sentinel — via the CommonSecurityLog/CEF pipeline, a custom log table, or W3CIISLog for IIS-fronted proxies. Adjust table and field names to your ingestion path.
// Hunt for CVE-2026-71362 exploitation patterns: bursts of account-endpoint
// requests, password-reset abuse, and cross-account access from single sources.
let AccountEndpoints = dynamic([
"/customer/account/login",
"/customer/account/forgotpassword",
"/customer/account/resetpassword",
"/customer/account/create",
"/rest/V1/customers",
"/graphql"
]);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL has_any (AccountEndpoints)
| summarize
RequestCount = count(),
UniqueAccounts = dcount(extract(@"email=([^&]+)", 1, AdditionalExtensions)),
Methods = make_set(RequestMethod),
StatusCodes = make_set(ApplicationProtocol)
by SourceIP, bin(TimeGenerated, 5m)
| where RequestCount > 50 or UniqueAccounts > 10
| sort by RequestCount desc;
// Post-exploitation hunt: PHP/web processes spawning shells on Magento hosts
// (requires Sysmon-for-Linux or Defender for Endpoint process telemetry in Sentinel)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("php-fpm", "php", "nginx", "apache2", "httpd")
| where FileName in~ ("sh", "bash", "dash", "curl", "wget", "python", "python3", "perl", "nc", "ncat")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName,
ProcessCommandLine, InitiatingProcessCommandLine, AccountName
| sort by TimeGenerated desc;
Velociraptor VQL Hunt
Run this against your Magento web servers to catch post-exploitation: web-spawned processes, recent PHP writes in the web root, and unexpected outbound connections from PHP-FPM workers.
-- CVE-2026-71362 post-exploitation hunt on Magento/Adobe Commerce hosts
-- 1) Web server / PHP-FPM spawned shell processes
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(sh|bash|dash|curl|wget|python|perl|nc|ncat)$'
AND Ppid IN (
SELECT Pid FROM pslist()
WHERE Name =~ '(php-fpm|php|nginx|apache2|httpd)'
)
-- 2) Recently modified PHP files in web root (potential web shell / skimmer)
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs='/var/www/html/**/*.php')
WHERE Mtime > now() - (7 * 24 * 3600)
ORDER BY Mtime DESC
-- 3) Outbound connections from PHP/web processes (data exfil, C2)
SELECT Pid, Name, Status, LocalAddress, LocalPort, RemoteAddress, RemotePort
FROM netstat()
WHERE Name =~ '(php-fpm|php|nginx|apache2|httpd)'
AND Status =~ 'ESTABLISHED'
AND NOT RemoteAddress =~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)'
Remediation & Hardening Script (Bash)
This script does not patch the application (patching is a composer/Cloud-console operation) — it verifies your deployed version, audits for signs of compromise, and tightens immediate exposure while you schedule the patch window.
#!/bin/bash
# CVE-2026-71362 Triage & Hardening - Adobe Commerce / Magento
# Run on the Magento application host. Requires sudo for some checks.
set -euo pipefail
DOCROOT="${1:-/var/www/html}"
LOG="/var/log/cve-2026-71362-triage-$(date +%Y%m%d-%H%M%S).log"
exec > >(tee -a "$LOG") 2>&1
echo "=== [1] Installed Adobe Commerce / Magento version ==="
if [ -f "$DOCROOT/bin/magento" ]; then
sudo -u www-data php "$DOCROOT/bin/magento" --version
fi
composer show magento/product-community-edition 2>/dev/null | grep -E '^(name|versions)' || true
composer show magento/project-community-edition 2>/dev/null | grep -E '^(name|versions)' || true
echo "=== [2] Unpatched core file integrity check ==="
# Flag PHP files modified in the last 14 days under web root (potential web shells)
find "$DOCROOT" -type f \( -name '*.php' -o -name '*.phtml' \) -mtime -14 \
-not -path '*/var/*' -not -path '*/generated/*' -printf '%T@ %p\n' | sort -rn | head -50
echo "=== [3] Audit admin users (unexpected admins = compromise indicator) ==="
sudo -u www-data php "$DOCROOT/bin/magento" admin:user:list 2>/dev/null || \
echo "Manual check: SELECT * FROM admin_user ORDER BY created DESC;"
echo "=== [4] Recent password-reset / account activity spikes in DB ==="
echo "Review: SELECT customer_id, email, updated_at FROM customer_entity ORDER BY updated_at DESC LIMIT 50;"
echo "Review: SELECT * FROM customer_entity WHERE updated_at > DATE_SUB(NOW(), INTERVAL 24 HOUR);"
echo "=== [5] Access log analysis: bursts against account endpoints ==="
ACCESS_LOG="/var/log/nginx/access.log"
[ -f "$ACCESS_LOG" ] || ACCESS_LOG="/var/log/apache2/access.log"
if [ -f "$ACCESS_LOG" ]; then
grep -E '(customer/account/(login|forgotpassword|resetpassword|create)|/rest/V1/customers|/graphql)' \
"$ACCESS_LOG" | awk '{print $1}' | sort | uniq -c | sort -rn | head -20
fi
echo "=== [6] PHP-FPM process anomaly check ==="
ps -eo pid,ppid,comm,args | awk '$3 ~ /php-fpm|nginx|apache2|httpd/ {print}' | head -20
echo "Child shells under web processes (investigate any hits):"
for pid in $(pgrep -f 'php-fpm|nginx|apache2|httpd'); do
pgrep -P "$pid" -a 2>/dev/null | grep -E 'sh|bash|curl|wget|python|perl' || true
done
echo "=== [7] Immediate exposure reduction (choose one while patching) ==="
echo "Option A - Rate-limit account endpoints at nginx:"
cat <<'EOF'
limit_req_zone $binary_remote_addr zone=acct:10m rate=5r/m;
location ~ ^/(customer/account/(login|forgotpassword|resetpassword)) {
limit_req zone=acct burst=3 nodelay;
proxy_pass http://backend;
}
EOF
echo "Option B - Enable/verify CDN WAF managed rules (Cloudflare/Akamai/Fastly) targeting ATO."
echo "Option C - Force customer password resets + revoke all active sessions after patching."
echo "=== Triage complete. Log: $LOG ==="
Remediation
- Apply Adobe's security update immediately. CVE-2026-71362 is covered by Adobe's security bulletin for Commerce/Magento. Pull the official advisory from Adobe's security page — https://helpx.adobe.com/security/products/magento.html — and apply the hotfix or upgrade to the patched release line for your version train (Adobe Commerce on-premises, Adobe Commerce on Cloud, and Magento Open Source each have separate distribution paths; Cloud customers should confirm the patch has been applied via the Cloud console/Adobe's managed update channel).
- Verify patch application in production. Check
composer showoutput andbin/magento --versionagainst the fixed versions listed in the Adobe bulletin. A "deployed" tag in CI is not evidence — verify on the live host. - Treat unpatched exposure time as a compromise window. If your storefront was internet-facing and unpatched after exploitation began, run the triage steps above: audit
admin_userfor rogue admins, review recent customer password/email changes, and diff the codebase against a known-good copy for injected PHP or JavaScript (Magecart skimmers often follow account-takeover bugs). - Force customer session invalidation and password resets for any accounts showing anomalous access during the exposure window. Attackers who already established sessions keep them until revoked — patching alone does not evict them.
- Harden the account attack surface: enforce rate limiting and CAPTCHA/bot controls on login, registration, and password-reset endpoints; ensure your WAF/CDN has account-takeover rulesets enabled; restrict
/adminand/restaccess by IP allowlist where operationally feasible. - Monitor for downstream fraud. Watch for spikes in gift card purchases, address changes followed by orders, and payment-method additions — the fraud team is your last detection layer for ATO that already succeeded.
- Check CISA KEV (catalog) for CVE-2026-71362; if listed, note the federal remediation due date as a forcing function for your own change board.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.