Adobe Commerce Session Takeover

Adobe Commerce is an e-commerce platform used by many organizations to manage their online stores. The vulnerability in Adobe Commerce allows attackers to take over a user's session, potentially leading to unauthorized access to sensitive data and system configuration.

Affected versions: 15 If you don't recognise this software, you're probably not affected.

1. Upgrade to Adobe Commerce 2.4.10 or later.
2. Maven: Update your pom.xml dependency version
3. You can also download the patch from the official Adobe website: https://adobe.com/go/commerscach-patch

Immediate mitigations:
- Restrict network access to your Adobe Commerce instance (firewall it from the public internet)
- Audit admin account activity for suspicious access patterns
- Monitor for unauthorized token creation

• Vendor Advisory
• Vendor Advisory
• Exploit
• www.cisa.gov