Adobe Commerce/Magento Incorrect Authorization Exploitation (CVE-2026-71362)

let magentoHosts = dynamic(["magento", "commerce"]);
let suspiciousPaths = dynamic(["/rest/", "/graphql", "/admin/", "/index.php/admin", "/rest/V1/customers", "/rest/all/V1", "/rest/default/V1"]);
W3CIISLog
| where csUriStem has_any (suspiciousPaths) or cIP != ""
| where csMethod in ("POST", "PUT", "DELETE", "PATCH")
| extend AuthHeader = tostring(csUserAgent)
| where (scStatus in (200, 201) and csUriStem has_any ("/rest/", "/graphql", "/admin"))
| summarize RequestCount = count(), Paths = make_set(csUriStem, 25), Statuses = make_set(scStatus, 10) by cIP, sSiteName, bin(TimeGenerated, 10m)
| where RequestCount > 20
| project TimeGenerated, cIP, sSiteName, RequestCount, Paths, Statuses

index=web (sourcetype="ms:iis:auto" OR sourcetype="apache:access" OR sourcetype="nginx:plus:kv")
(uri_path="*/rest/*" OR uri_path="*/graphql*" OR uri_path="*/admin*" OR uri_path="*index.php/admin*")
method IN ("POST","PUT","DELETE","PATCH")
status IN (200,201,302)
| bucket _time span=10m
| stats count AS req_count, values(uri_path) AS paths, values(status) AS statuses, dc(uri_path) AS distinct_paths by src_ip, host, _time
| where req_count > 20
| sort - req_count

sequence by source.ip with maxspan=10m
  [ network where url.path : ("*/rest/*", "*/graphql*", "*/admin*") and http.request.method in ("POST","PUT","DELETE") and http.response.status_code in (200,201) ]
  [ network where url.path : ("*/rest/V1/customers*", "*/admin/admin/user*", "*/rest/*/V1/integration*") and http.response.status_code in (200,201) ]

SELECT sourceip, url, "http_method" AS method, "http_response_code" AS status, COUNT(*) AS req_count FROM events WHERE (url ILIKE '%/rest/%' OR url ILIKE '%/graphql%' OR url ILIKE '%/admin%') AND "http_method" IN ('POST','PUT','DELETE','PATCH') AND "http_response_code" IN ('200','201') GROUP BY sourceip, url, method, status HAVING COUNT(*) > 20 ORDER BY req_count DESC LAST 1 HOURS

_sourceCategory=web/magento ("/rest/" OR "/graphql" OR "/admin")
| parse regex "(?<method>[A-Z]+)\s(?<uri>\S+)\sHTTP" nodrop
| parse regex "\"\s(?<status>\d{3})\s" nodrop
| where method in ("POST","PUT","DELETE","PATCH") and (status = "200" or status = "201")
| timeslice 10m
| count as req_count, values(uri) as paths by src_ip, _timeslice
| where req_count > 20
| sort by req_count desc

rule magento_cve_2026_71362_authz_bypass {
  meta:
    author = "argus"
    description = "Detects authorization-bypass exploitation of Adobe Commerce/Magento CVE-2026-71362"
    severity = "HIGH"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.method in ["POST", "PUT", "DELETE", "PATCH"]
    re.regex($e.target.url, `/(rest|graphql|admin)/?`)
    $e.network.http.response_code in [200, 201]
    $e.principal.ip = $ip
  match:
    $ip over 10m
  condition:
    #e > 20
}

#event_simpleName=/HttpRequest/i
| in(field="HttpMethod", values=["POST","PUT","DELETE","PATCH"])
| RequestUrl=/\/(rest|graphql|admin)/i
| in(field="HttpStatusCode", values=["200","201"])
| groupBy([RemoteAddressIP4], function=[count(as=req_count), collect([RequestUrl])])
| req_count > 20