What is the CVSS score of CVE-2026-34652?

CVE-2026-34652 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Adobe Commerce are affected by CVE-2026-34652?

Adobe Commerce (Magento) deployments in versions 2.4.4-p17 and earlier face a critical availability risk: remote, unauthenticated attackers can crash the storefront through a vulnerable third-party…

How to fix or mitigate CVE-2026-34652?

Within 24 hours: Identify all Adobe Commerce instances running versions 2.4.4-p17 or earlier and confirm network exposure; prioritize customer-facing production systems. Within 7 days: Deploy Web Application Firewall (WAF) rules to filter requests targeting the vulnerable third-party component; implement rate-limiting and request throttling on affected endpoints; establish monitoring and alerting for exploitation attempts in application logs. Within 30 days: Monitor Adobe security bulletins (APSB26-49) for patch availability; develop and test an upgrade migration plan to move affected systems to patched versions upon vendor release; consider staged rollout starting with non-production environments first.

Adobe Commerce CVE-2026-34652

EUVD-2026-29761 HIGH

Dependency on Vulnerable Third-Party Component (CWE-1395)

2026-05-12 adobe

GHSA-gcpg-85pc-655w

Denial Of Service Adobe Adobe Commerce

7.5

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote, unauthenticated, low-complexity request with no user interaction yields AV:N/AC:L/PR:N/UI:N; impact is a crash so A:H with C:N/I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:36 vuln.today

CVE Published

May 12, 2026 - 19:50 nvd

HIGH 7.5

DescriptionCVE.org

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Dependency on Vulnerable Third-Party Component vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Denial-of-service in Adobe Commerce (Magento) versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets a remote unauthenticated attacker crash the application by exercising a bundled vulnerable third-party component, taking the storefront offline. The flaw carries CVSS 7.5 with an availability-only impact and no confidentiality or integrity effect; there is no public exploit identified at time of analysis, and EPSS is low at 0.07%. It was reported by Adobe and addressed in security bulletin APSB26-49.

Technical ContextAI

Adobe Commerce is Adobe's enterprise e-commerce platform (formerly Magento), a large PHP application that bundles numerous third-party libraries and dependencies. This issue is classified as CWE-1395 (Dependency on Vulnerable Third-Party Component), meaning the root cause is not Adobe's own code but a flaw inherited from an embedded upstream library that Adobe ships. When that component processes attacker-influenced input, it can be driven into a fault that terminates or hangs the application process, producing a denial of service. The CPE cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:* confirms the affected product is the Adobe Commerce application across the enumerated version lines; Adobe did not publicly name the specific vulnerable dependency in the referenced advisory.

RemediationAI

Apply the fixed release for your branch as published in Adobe security bulletin APSB26-49 (https://helpx.adobe.com/security/products/magento/apsb26-49.html); the listed versions (2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and the 2.4.9-beta line) and earlier are affected, so upgrade to the next patch level for your version series as specified in that bulletin - Patch available per vendor advisory; consult APSB26-49 for the exact fixed version matching your branch. If immediate patching is not possible, reduce exposure of the internet-facing storefront and admin: place the application behind a WAF or reverse proxy to rate-limit and filter malformed requests that could trigger the crash (trade-off: may block legitimate edge cases and adds latency), restrict access to non-essential endpoints, and ensure the PHP-FPM/web tier auto-restarts on failure and runs with sufficient process redundancy so a single crash does not take the whole site down (trade-off: masks rather than fixes the underlying dependency flaw). These are stopgaps only; because the root cause is a bundled third-party component, the durable fix is the vendor patch.