What is the CVSS score of CVE-2026-34653?

CVE-2026-34653 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Adobe Commerce are affected by CVE-2026-34653?

Adobe Commerce (Magento) versions 2.4.9-beta1 through 2.4.4-p17 contain a path traversal vulnerability (CVE-2026-34653) that allows authenticated administrators to read and write arbitrary files on…

How to fix or mitigate CVE-2026-34653?

Within 24 hours: Inventory all Adobe Commerce deployments running versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier; restrict administrator account access to known trusted networks or require VPN; enable comprehensive audit logging for all administrative user activity. Within 7 days: Deploy Web Application Firewall (WAF) rules to block path traversal attack patterns in admin endpoints, apply principle of least privilege to the web application runtime user's filesystem permissions, and review administrative access logs for unauthorized activity. Within 30 days: Establish vendor monitoring for patch release; upon availability, validate the patch in a staging environment and deploy to production systems as a priority update.

Adobe Commerce CVE-2026-34653

EUVD-2026-29762 HIGH

Path Traversal (CWE-22)

2026-05-12 adobe

GHSA-jr4r-4m6q-5fpc

Path Traversal Adobe Adobe Commerce

8.7

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

8.7 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

Network-reachable admin function requiring administrative privileges (PR:H), no user interaction; path traversal enables file read and write (C:H/I:H) with changed scope, no availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:36 vuln.today

CVE Published

May 12, 2026 - 19:50 nvd

HIGH 8.7

DescriptionCVE.org

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system read and write. An authenticated attacker with administrative privileges could exploit this vulnerability to read or write files outside the restricted directory. Exploitation of this issue does not require user interaction. Scope is changed.

AnalysisAI

Arbitrary file system read and write in Adobe Commerce (Magento) versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets an authenticated administrator escape the intended restricted directory via path traversal, reading or writing files anywhere the web application user has access. Because scope is changed (S:C), the impact can extend beyond the vulnerable component. No public exploit identified at time of analysis, and EPSS is low (0.09%, 26th percentile), consistent with the high-privilege prerequisite.

Technical ContextAI

Adobe Commerce is Adobe's enterprise e-commerce platform (the commercial successor to Magento Open Source), a PHP application typically deployed behind a web server with admin functionality exposed over HTTP. The flaw is a CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), meaning user-controllable input reaching a file operation is not properly canonicalized or confined, so sequences such as '../' allow references outside the intended base directory. The affected CPE is cpe:2.3:a:adobe:adobe_commerce, and the changed-scope designation indicates the file operations run in a security context that can affect resources beyond the vulnerable module (e.g., the underlying host filesystem or adjacent components).

RemediationAI

Apply the fixed builds published by Adobe in security bulletin APSB26-49 (https://helpx.adobe.com/security/products/magento/apsb26-49.html); Patch available per vendor advisory - upgrade each branch to the corresponding fixed patch level above the listed vulnerable versions (for example, the next patch release beyond 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, and 2.4.4-p17), and avoid running the 2.4.9-beta1 pre-release in production. Because exploitation requires an authenticated admin session, prioritize compensating controls that harden admin access until patched: restrict the Admin panel to a VPN or allowlisted IP ranges and enforce a non-default admin URL path, require multi-factor authentication and rotate/audit admin accounts to remove stale or over-privileged users, and monitor for anomalous file writes under the Magento web root (side effect: IP allowlisting can break remote admin or third-party integrations, and MFA rollout requires operational coordination). Review web server file permissions so the PHP process cannot write outside required directories, noting this may interfere with legitimate media/import features.