What is the CVSS score of CVE-2026-34645?

CVE-2026-34645 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Adobe Commerce are affected by CVE-2026-34645?

Adobe Commerce storefronts running versions 2.4.4-2.4.9-beta1 are exposed to unauthenticated remote attacks that can modify customer data, payment information, and system configurations without…

How to fix or mitigate CVE-2026-34645?

Within 24 hours, identify and inventory all Adobe Commerce instances running versions 2.4.4-p17 through 2.4.9-beta1, documenting internet exposure status. Within 7 days, implement interim security controls including WAF rules to restrict administrative endpoint access, enable detailed audit logging of system modifications, and establish real-time alerting for suspicious administrative activities. Within 30 days, confirm patch availability timeline with Adobe Support and develop a phased upgrade strategy for affected systems, prioritizing customer-facing production environments.

Adobe Commerce CVE-2026-34645

EUVD-2026-29754 HIGH

Incorrect Authorization (CWE-863)

2026-05-12 adobe

GHSA-cffg-9fwp-87hv

Adobe Authentication Bypass Adobe Commerce

7.5

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Network-reachable, no auth or interaction (AV:N/AC:L/PR:N/UI:N) per Adobe; a security-feature bypass yields unauthorized write, so I:H with C:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:37 vuln.today

CVE Published

May 12, 2026 - 19:50 nvd

HIGH 7.5

DescriptionCVE.org

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

AnalysisAI

Improper authorization in Adobe Commerce (Magento) 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets a remote unauthenticated attacker (CVSS PR:N) bypass a security control and gain unauthorized write access to the affected system, with no user interaction. There is no public exploit identified at time of analysis and the EPSS score is low (0.09%), but the network-reachable, no-auth, no-interaction vector combined with Adobe's own reporting warrants prompt patching. This is not in CISA KEV and shows no confirmed exploitation.

Technical ContextAI

Adobe Commerce is a PHP-based e-commerce platform (the commercial Magento) commonly exposed to the public internet as an online storefront and admin panel. The root cause is CWE-863 (Incorrect Authorization): a code path performs an action or grants access without correctly evaluating whether the requesting principal is permitted, so an authorization decision that should deny the request instead allows it. Per the CPE (cpe:2.3:a:adobe:adobe_commerce:*), all Adobe Commerce editions up to the listed patch levels are in scope. Because the impact is integrity-only (C:N/I:H/A:N), the flaw permits writing/modifying data or state that should be protected, rather than reading confidential data or causing an outage - consistent with a 'security feature bypass' that circumvents an access control guarding a write operation.

RemediationAI

Apply the vendor fix per Adobe security bulletin APSB26-49 (https://helpx.adobe.com/security/products/magento/apsb26-49.html), upgrading each affected branch to the corresponding patched release above the listed levels (e.g., from 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, and 2.4.4-p17 to the next patch build named in the bulletin - consult APSB26-49 for the exact target versions, which are not restated here to avoid inventing numbers). Because exploitation is network-based and unauthenticated, prioritize internet-facing storefronts. Until patching completes, restrict access to non-public administrative and API endpoints via IP allowlisting or a WAF, and enable/tune Adobe Commerce's WAF or Fastly/Web Application Firewall rules to constrain the affected request paths; note this can break legitimate integrations or headless/API clients if scoped too broadly, so test allowlists against known consumers. Monitor logs for unexpected write/modification actions to detect abuse of the authorization bypass.