Search: “adobe commerce”

44 stories

Sansec (Magento / e-commerce security)May 12, 10:55 UTC · May 12, 2026Vulnerability in the wild

SessionReaper, unauthenticated RCE in Magento & Adobe Commerce (CVE-2025

Sansec (Magento / e-commerce security)Apr 14, 19:49 UTC · Apr 14, 2026Vulnerability in the wildCVE-2025-542362

Adobe Commerce Flaw CVE-2025-54236 Lets Hackers Take Over Customer Accounts

The Hacker NewsSep 10, 01:08 UTC · Sep 10, 2025Vulnerability in the wildCVE-2025-54236 CVE-2025-54261

Critical Adobe Commerce, Magento vulnerability under attack (CVE-2025-54236)

Help Net SecurityOct 23, 00:00 UTC · Oct 23, 2025Vulnerability in the wildCVE-2025-54236

CosmicSting attack threatens 75% of Adobe Commerce stores

Sansec (Magento / e-commerce security)Apr 14, 20:16 UTC · Apr 14, 2026Vulnerability in the wildCVE-2024-34102 CVE-2024-2961 CVE-2026-75650

PolyShell flaw exposes Magento and Adobe Commerce to file upload attacks

Security AffairsMar 21, 10:09 UTC · Mar 21, 2026Vulnerability in the wild

Over 250 attacks hit Adobe Commerce and Magento via critical CVE-2025

Security AffairsOct 23, 09:22 UTC · Oct 23, 2025Vulnerability in the wildCVE-2025-54236

Critical Magento 0-Day Vulnerability Under Active Exploitation — Patch Released

The Hacker NewsFeb 15, 00:00 UTC · Feb 15, 2022Vulnerability in the wildCVE-2022-24086

Mass PolyShell attack wave hits 471 stores in one hour

Sansec (Magento / e-commerce security)Mar 31, 07:45 UTC · Mar 31, 2026Vulnerability in the wildCVE-2026-75650

Magento 2 critical vulnerability (CVE-2022-24086 & CVE-2022

Sansec (Magento / e-commerce security)Apr 14, 20:16 UTC · Apr 14, 2026Vulnerability in the wildCVE-2022-24086 CVE-2026-75650 CVE-2025-542361

Adobe Releases Patch Fixing 254 Vulnerabilities, Closing High

The Hacker NewsJun 11, 07:42 UTC · Jun 11, 2025Vulnerability in the wildCVE-2025-47110 CVE-2025-43585 CVE-2025-30327+3 CVEs

Adobe Patch Tuesday fixed critical vulnerabilities in Magento, Acrobat and Reader

Security AffairsFeb 14, 09:25 UTC · Feb 14, 2024Vulnerability in the wildCVE-2024-20726 CVE-2024-20727 CVE-2024-20728+15 CVEs

Surge in Magento 2 template attacks

Sansec (Magento / e-commerce security)Apr 14, 19:49 UTC · Apr 14, 2026Vulnerability in the wildCVE-2026-75650

Vendors defeat Magento security patch (+ simple check)

Sansec (Magento / e-commerce security)Apr 14, 19:49 UTC · Apr 14, 2026Vulnerability in the wildCVE-2022-24086 CVE-2022-24087 CVE-2026-75650

Over 200 PrestaShop stores expose installer, allowing full takeover

Sansec (Magento / e-commerce security)Apr 14, 13:40 UTC · Apr 14, 2026Vulnerability in the wildCVE-2026-75650

Found defunct.dat on your site? You've got a problem.

Sansec (Magento / e-commerce security)Apr 14, 19:49 UTC · Apr 14, 2026Vulnerability in the wildCVE-2026-75650

Microsoft, Adobe, SAP deliver critical fixes for September 2025 Patch Tuesday

Help Net SecuritySep 10, 00:00 UTC · Sep 10, 2025Vulnerability in the wildCVE-2025-54918 CVE-2025-54916 CVE-2025-55232+8 CVEs

Microsoft Patch Tuesday, August 2023 Edition

Krebs on SecurityAug 9, 13:55 UTC · Aug 9, 2023Vulnerability in the wildCVE-2023-36884 CVE-2023-38180 CVE-2023-21709+1 CVEs

Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws

Adobe patches seven flaws in ColdFusion, Commerce, and Campaign Classic, including actively exploited CVE-2026-71362 enabling customer account takeover.

Adobe issued Priority 1 updates fixing CVSS 10.0 flaws in ColdFusion (CVE-2026-48362, OS command injection) and Campaign Classic (CVE-2026-71398, CVE-2026-27302, incorrect authorization), plus CVE-2026-71362 (CVSS 9.1) in Adobe Commerce and Magento Open Source. Sansec reports threat actors are actively exploiting CVE-2026-71362 to switch customer sessions to other accounts and access private customer data. Adobe-hosted Campaign Classic instances are already remediated, while on-premise deployments are urged to patch within 72 hours. ColdFusion fixes ship in versions 2025.0.12 and 2023.0.23, and Campaign Classic fixes in v7 7.4.4 build 9400.

The Hacker NewsAug 15, 00:00 UTC · Aug 15, 2026Vulnerability in the wildCVE-2026-48362 CVE-2026-48273 CVE-2026-71384+5 CVEs

Unpublished security flaws (0days) massively exploited

Sansec (Magento / e-commerce security)Apr 14, 20:16 UTC · Apr 14, 2026Vulnerability in the wildCVE-2026-75650

September 2026 Patch Tuesday roundup: Plugs for two zero day holes among almost 1,000 fixes in Windows

Microsoft's September 2026 Patch Tuesday ships 964 fixes including two exploited Windows zero-days (CVE-2026-85880, CVE-2026-81963) and a wormable DNS RCE.

Microsoft's September 2026 Patch Tuesday includes 964 Microsoft vulnerabilities requiring customer action, a record attributed to AI-assisted bug discovery, plus 174 third-party/open-source and 23 Chromium/Edge CVEs. Two zero-days are exploited in the wild: CVE-2026-85880, a Windows ALPC heap overflow enabling AppContainer sandbox escape and privilege escalation, and CVE-2026-81963, a Windows Update Stack escalation to SYSTEM. CVE-2026-69730, an unauthenticated Windows DNS RCE, is not yet exploited but Microsoft expects exploitation, and roughly 20 bugs could be wormable. Separately, SAP issued a critical CVSS 10.0 fix for the EPP component used in S/4HANA and NetWeaver.

CSO OnlineSep 9, 03:27 UTC · 8d agoVulnerability in the wildCVE-2026-85880 CVE-2026-81963 CVE-2026-69730+2 CVEs1