What is the CVSS score of CVE-2026-34651?

CVE-2026-34651 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Adobe Commerce are affected by CVE-2026-34651?

Adobe Commerce (Magento) versions 2.4.4 through 2.4.9 contain an unauthenticated denial-of-service vulnerability that allows remote attackers to exhaust server resources and take e-commerce platforms…

How to fix or mitigate CVE-2026-34651?

Within 24 hours, audit all Adobe Commerce installations to identify and document deployed versions, specifically flagging instances of 2.4.4-p17, 2.4.5-p16, 2.4.6-p14, 2.4.7-p9, 2.4.8-p4, 2.4.9-beta1, or earlier. Within 7 days, implement application-layer rate-limiting and request throttling on production systems, deploy Web Application Firewall rules to detect resource-exhaustion patterns, and establish real-time monitoring alerts on CPU, memory, and request-queue metrics. Within 30 days, develop and begin a phased upgrade plan to unaffected versions when Adobe releases security patches, evaluate availability of community or vendor-provided WAF rule sets, and conduct load testing to validate DoS mitigations.

Adobe Commerce CVE-2026-34651

EUVD-2026-29760 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-05-12 adobe

GHSA-6w96-qjj8-6ccj

Denial Of Service Adobe Adobe Commerce

7.5

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote, low-complexity, unauthenticated request path with no user interaction causes availability-only impact (A:H), so C and I are N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:39 vuln.today

CVE Published

May 12, 2026 - 19:50 nvd

HIGH 7.5

DescriptionCVE.org

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Denial-of-service in Adobe Commerce (Magento) 2.4.4-p17, 2.4.5-p16, 2.4.6-p14, 2.4.7-p9, 2.4.8-p4, 2.4.9-beta1 and earlier allows a remote attacker to exhaust system resources and render the application unavailable without any authentication or user interaction. The flaw is an Uncontrolled Resource Consumption (CWE-400) issue reported by Adobe (APSB26-49); it carries a CVSS 7.5 (availability-only impact) with no confidentiality or integrity effect. There is no public exploit identified at time of analysis and the EPSS score is very low (0.04%), indicating no observed weaponization to date.

Technical ContextAI

Adobe Commerce (formerly Magento) is a widely deployed PHP-based enterprise e-commerce platform, identified in the CPE data as cpe:2.3:a:adobe:adobe_commerce:*. The root cause class is CWE-400 (Uncontrolled Resource Consumption), meaning some request-handling path fails to bound the CPU, memory, connection, or processing work an attacker can trigger. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, the resource-exhaustion path is reachable over the network against an unauthenticated, network-facing endpoint of the storefront/application, and a single or repeated crafted request can drive consumption until the application can no longer serve legitimate users. Adobe has not published the specific vulnerable component in the public advisory summary, so the exact endpoint or parser is not disclosed in the available data.

RemediationAI

Apply the fixed Adobe Commerce/Magento releases published in Adobe security bulletin APSB26-49 (https://helpx.adobe.com/security/products/magento/apsb26-49.html); the listed versions (2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17) are the affected baselines, so upgrade to the corresponding patched patch-level released in that bulletin - consult APSB26-49 for the exact post-fix version, as a precise fixed version string is not included in the available input data (Patch available per vendor advisory). Until patching, reduce exposure by placing the storefront behind a WAF or reverse proxy with rate limiting and request-size/timeout caps on public endpoints, enabling Adobe Commerce's built-in and CDN/Fastly rate limiting, and monitoring for abnormal CPU/memory or connection spikes; note that aggressive rate limiting can throttle legitimate high-traffic customers or bots you rely on (e.g., payment callbacks, search crawlers), so tune thresholds against real traffic before enforcing. Because the specific vulnerable endpoint is not disclosed publicly, targeted endpoint blocking is not reliable, making prompt upgrade the only definitive fix.