Executive Summary: Active Weaponization Against Enterprise E-Commerce

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency mandate adding CVE-2026-71362 to its Known Exploited Vulnerabilities (KEV) Catalog. The critical flaw impacts Adobe Commerce and Magento Open Source—the ubiquitous e-commerce software underpinning tens of thousands of global retail brands, B2B procurement portals, and online storefronts processing billions of dollars in credit card transactions.

Carrying a Common Vulnerability Scoring System (CVSS v3.1) base rating of 8.8 High, the vulnerability is classified under CWE-863 (Incorrect Authorization). The flaw permits unauthenticated remote threat actors to manipulate shopping cart quote objects and checkout state machines via publicly accessible GraphQL and REST APIs. In-the-wild telemetry confirms automated exploitation campaigns executing digital skimming attacks, substituting merchant payment tokens, and exfiltrating unmasked customer shipping addresses and credit card records.

Architectural Breakdown: Authorization Bypass in GraphQL Quote Service

In modern headless and hybrid Adobe Commerce deployments, checkout interactions are processed via GraphQL mutations (such as setPaymentMethodOnCart and placeOrder). To support guest shoppers who browse without logging into customer accounts, the Magento core maintains a distinction between masked guest quote IDs (UUID strings) and internal customer quote IDs (sequential integers).

The security boundary collapsed within MagentoQuoteModelQuoteIdMask and the associated GraphQL resolver middleware:

  • Improper Mask Resolution: When an unauthenticated client invoked the setPaymentMethodOnCart mutation with an intentionally crafted combination of a masked quote hash and a secondary guest quote header, the resolver failed to verify that the active session held ownership over the referenced cart.
  • Cart Injection & State Mutation: The attacker could bind arbitrary order line items, attach rogue delivery webhooks, or substitute third-party payment gateway tokens (such as PayPal, Stripe, or Braintree client tokens) tied to an attacker-controlled receiver account.
  • Order Redirection: When legitimate customers completed checkout on high-traffic retail sites, the transaction settlement flowed through the modified quote parameters, successfully routing consumer funds into fraudulent merchant accounts while logging full customer billing information into attacker-controlled endpoints.

Attack Mechanics & Raw GraphQL Exploit Payload

The following raw GraphQL query demonstrates how adversaries exploit the authorization breakdown without supplying authenticated merchant or customer credentials: 

POST /graphql HTTP/1.1
Host: store.enterprise-retail.com
Content-Type: application/json
User-Agent: Adversary-Magecart-Exploit-Client

{
  "query": "mutation { setPaymentMethodOnCart(input: { cart_id: "TARGET_GUEST_CART_HASH", payment_method: { code: "braintree", braintree: { payment_method_nonce: "ATTACKER_FRAUD_NONCE" } } }) { cart { selected_payment_method { code title } } } }"
}

Because the endpoint processed the mutation without asserting session ownership over TARGET_GUEST_CART_HASH, the response returns HTTP 200 OK, confirming the cart payment method was silently rewritten.

PCI DSS Compliance Exposure & Skimming Hazards

Under the PCI DSS v4.0 standard, requirements 6.4.3 and 11.6.1 enforce rigorous payment page tamper resistance and script integrity monitoring. Exploitation of CVE-2026-71362 circumvents conventional browser-based Content Security Policy (CSP) protections because the tampering occurs on the server-side GraphQL API plane rather than via injected JavaScript DOM skimmers. Retailers processing credit cards through unpatched instances face mandatory forensic audits, card brand non-compliance penalties, and revocation of payment processing privileges.

Actionable Remediation Playbook

  1. Apply Adobe Official Security Hotfixes: Install the official isolated security hotfix released by Adobe for your specific version: 
    # Apply official Magento hotfix via composer
composer require adobe-commerce/security-patch-cve-2026-71362
bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento cache:clean
  2. Enforce Rate Limiting and WAF Rules on GraphQL Endpoints: Deploy AWS WAF or Cloudflare rules restricting GraphQL request volumes and inspecting incoming mutations for quote tampering patterns: 
    # Cloudflare WAF Rule: Block unauthenticated payment method mutations
(http.request.uri.path eq "/graphql" and http.request.body.raw contains "setPaymentMethodOnCart" and not http.request.headers["authorization"] contains "Bearer") -> Block
  3. Audit Active Payment Gateway Logs: Review payment reconciliation logs across Braintree, Stripe, and Adyen for unexpected variance between store order totals and captured settlement batches.