What is the CVSS score of CVE-2026-34650?

CVE-2026-34650 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Adobe Commerce are affected by CVE-2026-34650?

A denial-of-service vulnerability in Adobe Commerce versions 2.4.9-beta1 through 2.4.4-p17 allows unauthenticated attackers to exhaust system resources and cause application downtime.

How to fix or mitigate CVE-2026-34650?

Within 24 hours: inventory all Adobe Commerce deployments and identify which versions are affected (2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier), and implement Web Application Firewall rules to block requests matching known resource-exhaustion patterns. Within 7 days: deploy rate limiting and request throttling controls at the network and application layer, configure monitoring and alerting for abnormal resource consumption spikes, and begin planning an upgrade path to unaffected Commerce versions once a patch is released. Within 30 days: evaluate and test upgrade strategies with Adobe support, monitor vendor security advisories for patch availability, and conduct a comprehensive assessment of the Commerce deployment for other resource-exhaustion vectors.

Adobe Commerce CVE-2026-34650

EUVD-2026-29759 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-05-12 adobe

GHSA-h5vc-cxc2-3gxr

Denial Of Service Adobe Adobe Commerce

7.5

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable, low-complexity, unauthenticated request with no user interaction causes availability-only resource exhaustion, so PR:N/UI:N and C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:35 vuln.today

CVE Published

May 12, 2026 - 19:50 nvd

HIGH 7.5

DescriptionCVE.org

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Application denial-of-service in Adobe Commerce (Magento) affects versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier, where an unauthenticated remote attacker can trigger uncontrolled resource consumption (CWE-400) to exhaust system resources without any user interaction. There is no public exploit identified at time of analysis and the EPSS probability is very low (0.01%, 2nd percentile), so while the CVSS availability impact is High (7.5), real-world weaponization appears unlikely in the near term. Impact is limited to availability, with no confidentiality or integrity effect.

Technical ContextAI

Adobe Commerce is Adobe's enterprise e-commerce platform (formerly Magento Commerce), a PHP-based application typically deployed behind web servers such as nginx or Apache and backed by MySQL/MariaDB, Elasticsearch/OpenSearch, and Redis. The root cause is CWE-400 (Uncontrolled Resource Consumption): a request-handling code path lets an attacker force the application to allocate or process resources (CPU, memory, connections, or worker threads) disproportionately to the request, without an enforced limit or quota. The single CPE, cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*, confirms the affected component is the Adobe Commerce application itself rather than a bundled third-party library. Adobe's advisory does not disclose the specific vulnerable endpoint or parameter.

RemediationAI

Apply the fixed release for your branch as published in Adobe security advisory APSB26-49 (https://helpx.adobe.com/security/products/magento/apsb26-49.html), upgrading to the patch level immediately above the listed vulnerable version on your 2.4.4 through 2.4.9 branch; take the exact fixed version numbers directly from APSB26-49, which is authoritative, rather than inventing them. As compensating controls until patching, place the storefront behind a WAF/CDN (such as the Adobe Commerce-supported Fastly integration) and enable rate limiting and request-body size limits on the web tier to blunt resource-exhaustion floods, and restrict or rate-limit anonymous access to expensive endpoints such as search, layered navigation, cart, and catalog query parameters. Trade-offs: aggressive rate limiting can throttle legitimate high-traffic promotions or bot-driven price crawlers you rely on, and overly tight body or parameter limits may break large legitimate cart or import operations, so tune thresholds and monitor for false positives.