What is the CVSS score of CVE-2026-34647?

CVE-2026-34647 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Adobe Commerce are affected by CVE-2026-34647?

Adobe Commerce versions 2.4.9-beta1 through 2.4.4-p17 and earlier contain a server-side request forgery (SSRF) vulnerability allowing remote attackers to bypass security controls and read…

How to fix or mitigate CVE-2026-34647?

Within 24 hours: Audit all Adobe Commerce instances to identify which are running versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 or earlier, and document the complete inventory. Within 7 days: Deploy Web Application Firewall (WAF) rules to detect and block suspicious outbound request patterns, implement strict input validation and URL whitelisting on all user-supplied URL parameters, restrict outbound server connections to essential external services only, and enable comprehensive logging of all external requests for monitoring. Within 30 days: Establish a vendor patch monitoring process specifically for CVE-2026-34647, develop a phased upgrade timeline for patched versions once released (prioritizing production systems), and conduct security testing to validate all compensating controls before applying vendor patches.

Adobe Commerce CVE-2026-34647

EUVD-2026-29756 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-12 adobe

GHSA-rpj7-34g9-f3f7

SSRF Adobe Adobe Commerce

7.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.4 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

vuln.today AI

7.4 HIGH

Network-reachable, low-complexity, unauthenticated SSRF requiring victim interaction (UI:R); scope changes as coerced requests reach other resources, yielding read-only confidentiality impact with no integrity or availability loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:35 vuln.today

CVE Published

May 12, 2026 - 19:50 nvd

HIGH 7.4

DescriptionCVE.org

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

AnalysisAI

Server-Side Request Forgery in Adobe Commerce (Magento) versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets a remote attacker bypass security controls and gain unauthorized read access by luring a victim to a maliciously crafted URL or compromised page. Rated CVSS 7.4 with a scope-changed impact, the flaw affects the e-commerce platform's server-side request handling. There is no public exploit identified at time of analysis, and EPSS is low (0.13%, 32nd percentile), so exploitation is currently theoretical rather than observed.

Technical ContextAI

Adobe Commerce is Adobe's enterprise e-commerce platform built on the Magento codebase (PHP), widely used for online storefronts. The root cause is CWE-918 (Server-Side Request Forgery): the application accepts attacker-influenced input that is used to construct a server-side request, allowing that request to be redirected toward internal or otherwise restricted resources. Because the CVSS scope is Changed (S:C), the vulnerable component can cause the server to act against resources beyond its own security authority, which here manifests as a bypass of intended security controls to read data the attacker should not reach. The affected CPE is cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*, confirming Adobe Commerce as the affected application.

RemediationAI

Upgrade Adobe Commerce to the fixed release line published in Adobe's advisory APSB26-49 (https://helpx.adobe.com/security/products/magento/apsb26-49.html); the listed versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, and 2.4.4-p17 and earlier are affected, so apply the corresponding patched patch-level for your branch as specified by Adobe (Patch available per vendor advisory; confirm the exact target version against APSB26-49 for your installed branch before upgrading). If immediate patching is not possible, reduce exposure by having the store's outbound/proxy layer restrict server-initiated requests to internal networks and cloud metadata endpoints (egress filtering / deny access to 169.254.169.254 and RFC1918 ranges from the application tier), which blunts SSRF read access but may break legitimate integrations that call internal services; additionally, apply a web application firewall rule to inspect and constrain URL-bearing parameters, and given the UI:R requirement, warn administrators and users against following untrusted links into the storefront/admin. Validate NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-34647) and the Adobe bulletin for the precise fixed version for your deployment.