What is the CVSS score of CVE-2026-34646?

CVE-2026-34646 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Adobe Commerce are affected by CVE-2026-34646?

Adobe Commerce (Magento) contains an authentication bypass vulnerability (CVE-2026-34646) that permits unauthenticated attackers to modify sensitive business data, creating material risk to…

How to fix or mitigate CVE-2026-34646?

Within 24 hours: Inventory all systems running Magento 2.4.4-p17, 2.4.5-p16, 2.4.6-p14, 2.4.7-p9, 2.4.8-p4, 2.4.9-beta1 or earlier versions; enable comprehensive audit logging on write operations and API endpoints; review access logs for suspicious activity patterns. Within 7 days: Deploy Web Application Firewall (WAF) rules to block authorization bypass requests; enforce multi-factor authentication on all administrative access; implement network segmentation to restrict Magento application exposure; conduct forensic review of recent data modifications for evidence of compromise. Within 30 days: Execute upgrade to an unaffected Magento version or establish comprehensive compensating controls; notify Adobe of your environment status and prepare for immediate patch deployment upon vendor release.

Adobe Commerce CVE-2026-34646

EUVD-2026-29755 HIGH

Incorrect Authorization (CWE-863)

2026-05-12 adobe

GHSA-8w9p-r848-78x9

Adobe Authentication Bypass Adobe Commerce

7.5

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Network-reachable, low-complexity, unauthenticated (PR:N) and no user interaction per the description; impact is limited to unauthorized write access, so I:H with C:N and A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:39 vuln.today

CVE Published

May 12, 2026 - 19:50 nvd

HIGH 7.5

DescriptionCVE.org

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

AnalysisAI

Improper authorization in Adobe Commerce (Magento) lets remote unauthenticated attackers bypass security controls and gain unauthorized write access across builds 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier. The flaw (CWE-863) requires no user interaction and is exploitable over the network per its CVSS:3.1 vector, though there is no public exploit identified at time of analysis and it is not on CISA KEV. EPSS is low (0.09%, 26th percentile), but CISA SSVC marks it 'Automatable: yes', meaning any working exploit could be scaled easily.

Technical ContextAI

Adobe Commerce is Adobe's enterprise e-commerce platform (formerly Magento Commerce), a PHP application built on the Magento framework that powers online storefronts, admin panels, and REST/GraphQL APIs. The root cause is CWE-863 (Incorrect Authorization): an authorization check that exists but is implemented incorrectly, so a request that should be denied is instead permitted. The single CPE (cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*) confirms the vulnerable component is the Adobe Commerce application itself rather than a bundled third-party library. Because the impact is limited to integrity (unauthorized write access) with no confidentiality or availability effect, the defective check most likely guards a write-oriented operation or endpoint rather than data disclosure.

RemediationAI

Apply the fixed release for your branch as published in Adobe Security Bulletin APSB26-49 (https://helpx.adobe.com/security/products/magento/apsb26-49.html); patch available per vendor advisory, but an exact fixed version string is not present in the analyzed input, so confirm the precise patched build (typically the next patch level above each affected version, e.g. the successor to 2.4.8-p4 / 2.4.7-p9) directly from APSB26-49 before deploying. Because no independently verified fix version is in this dataset, do not hardcode a version from assumption. Until patched, reduce exposure with compensating controls: place the Adobe Commerce admin and API endpoints behind a WAF or IP allowlist and restrict internet access to the storefront's privileged/write endpoints (side effect: may break legitimate remote integrations or headless clients, so allowlist known integration IPs), enforce Adobe Commerce's Web Application Firewall / Fastly rules if using Adobe-hosted infrastructure, and monitor logs for unexpected write/create operations that lack proper authorization. These controls narrow reachability but do not fix the underlying authorization defect, so schedule the upgrade promptly.