What is the CVSS score of CVE-2026-34648?

CVE-2026-34648 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Adobe Commerce are affected by CVE-2026-34648?

Adobe Commerce (Magento) versions through 2.4.9-beta1 contain a network-accessible denial-of-service vulnerability (CVE-2026-34648, CVSS 7.5) that allows unauthenticated attackers to exhaust server…

How to fix or mitigate CVE-2026-34648?

Within 24 hours: Inventory all Magento deployments and identify systems running versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17, or earlier; document business criticality and current network exposure. Within 7 days: deploy rate-limiting and request-filtering rules at the WAF and network edge to constrain resource consumption requests; implement continuous monitoring for abnormal CPU, memory, or connection spikes that may indicate exploitation attempts; establish and test incident response procedures for availability events. Within 30 days: monitor Adobe Security Bulletins and vendor advisories for patch availability; develop and stage upgrade paths to patched Magento versions or plan for alternative hosting infrastructure; evaluate auto-scaling or failover mechanisms to reduce DoS impact if interim controls prove insufficient.

Adobe Commerce CVE-2026-34648

EUVD-2026-29757 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-05-12 adobe

GHSA-358w-hqpf-q255

Denial Of Service Adobe Adobe Commerce

7.5

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated request triggers resource exhaustion with no user interaction, so AV:N/AC:L/PR:N/UI:N; impact is availability-only, giving C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:37 vuln.today

CVE Published

May 12, 2026 - 19:50 nvd

HIGH 7.5

DescriptionCVE.org

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Application denial-of-service in Adobe Commerce (Magento) affects versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier, where an Uncontrolled Resource Consumption flaw (CWE-400) lets a remote, unauthenticated attacker exhaust server resources without any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/A:H) reflects a high availability impact with no confidentiality or integrity loss. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.01%, 2nd percentile), indicating minimal observed exploitation interest despite the network-reachable attack surface.

Technical ContextAI

Adobe Commerce is Adobe's enterprise e-commerce platform built on the Magento codebase, typically deployed as an internet-facing PHP web application backed by MySQL/MariaDB, Redis, and OpenSearch/Elasticsearch. The root cause is CWE-400 (Uncontrolled Resource Consumption), a class of flaw where the application fails to bound the CPU, memory, connection, or processing work triggered by a request, allowing a small number of crafted requests to drive resource usage disproportionately high. The affected CPE is cpe:2.3:a:adobe:adobe_commerce, and because the impact is limited to availability (A:H, C:N, I:N), the flaw causes service exhaustion rather than data disclosure or code execution.

RemediationAI

Upgrade to the fixed Adobe Commerce release documented in Adobe security bulletin APSB26-49 (https://helpx.adobe.com/security/products/magento/apsb26-49.html), which supersedes the listed vulnerable patch levels (2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier); apply the corresponding cumulative patch or dot-release for your branch since the input does not specify a single fixed version string. As compensating controls until patched, place the storefront behind a WAF or CDN (Adobe's Fastly integration, Cloudflare, or AWS WAF) with rate limiting on the specific request paths to cap request volume per client, and enforce connection and request-body limits at the reverse proxy or web server (nginx limit_req/limit_conn or PHP-FPM process caps) to contain resource exhaustion - noting that aggressive rate limits can throttle legitimate high-traffic promotions or crawler traffic. Monitor CPU, memory, and PHP-FPM/worker saturation to detect exploitation attempts early.