What is the CVSS score of CVE-2026-34649?

CVE-2026-34649 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Adobe Commerce are affected by CVE-2026-34649?

Organizations running Adobe Commerce (Magento) versions 2.4.4-p17 through 2.4.9-beta1 face potential e-commerce platform outages due to a vulnerability allowing remote denial-of-service attacks…

How to fix or mitigate CVE-2026-34649?

Within 24 hours, conduct an inventory of all Adobe Commerce/Magento deployments and identify which versions from 2.4.4-p17 through 2.4.9-beta1 are in production; assess business criticality and current mitigation posture. Within 7 days, implement interim controls including rate limiting on affected endpoints, WAF rules to detect resource-exhaustion patterns, and application-level resource quotas; establish monitoring and alerting for anomalous traffic patterns. Within 30 days, develop and begin testing an upgrade plan to versions beyond the vulnerable range, and evaluate whether architectural changes such as load balancing, CDN deployment, or request filtering can reduce attack surface pending patch availability.

Adobe Commerce CVE-2026-34649

EUVD-2026-29758 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-05-12 adobe

GHSA-637x-gcp7-9gfx

Denial Of Service Adobe Adobe Commerce

7.5

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated network request causes resource exhaustion with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:38 vuln.today

CVE Published

May 12, 2026 - 19:50 nvd

HIGH 7.5

DescriptionCVE.org

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Uncontrolled resource consumption in Adobe Commerce (Magento) versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets a remote attacker exhaust system resources and force an application-level denial-of-service without any authentication or user interaction. The flaw carries a CVSS 7.5 (availability-only) rating and, per Adobe's APSB26-49 advisory, affects the e-commerce platform's server-side request handling. There is no public exploit identified at time of analysis and the EPSS score is very low (0.04%, 12th percentile), indicating no observed exploitation activity to date.

Technical ContextAI

Adobe Commerce (formerly Magento) is a widely deployed PHP-based e-commerce platform running on the Magento application framework, typically behind Apache/nginx with MySQL/MariaDB and often Elasticsearch/OpenSearch and Redis. The root cause is CWE-400 (Uncontrolled Resource Consumption): a code path fails to bound the CPU, memory, connections, or other finite resources it allocates while processing attacker-supplied input, so a relatively cheap request can cause disproportionate server-side work. The single CPE (cpe:2.3:a:adobe:adobe_commerce:*) confirms the vulnerability is in the Adobe Commerce application itself rather than a bundled third-party dependency, though Adobe has not published the specific vulnerable component or endpoint.

RemediationAI

Apply the security update from Adobe advisory APSB26-49 (https://helpx.adobe.com/security/products/magento/apsb26-49.html), which supersedes each listed vulnerable patch level - upgrade to the next available patch release for your branch (e.g. beyond 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, or 2.4.4-p17); consult APSB26-49 for the exact fixed version corresponding to your line, as the specific fix version is not enumerated in the available data. Patch available per vendor advisory (Adobe APSB26-49). Because the attack is unauthenticated network-based resource exhaustion, effective compensating controls until patching include placing a WAF or reverse proxy in front of the storefront to rate-limit and throttle requests, enforcing per-IP connection and request-rate caps at the load balancer, and tuning PHP-FPM/web server timeouts and memory_limit to fail individual requests fast rather than starving the pool - with the trade-off that aggressive rate limits can degrade legitimate high-traffic events such as sales. Monitor CPU/memory and 5xx error spikes to detect exploitation attempts.