What is the CVSS score of CVE-2026-34654?

CVE-2026-34654 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

Adobe Commerce CVE-2026-34654

EUVD-2026-29763 MEDIUM

Dependency on Vulnerable Third-Party Component (CWE-1395)

2026-05-12 adobe

GHSA-mw4p-x73x-h5hj

Adobe Denial Of Service Adobe Commerce

5.3

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

5.3 MEDIUM

Network-reachable unauthenticated DoS with no auth or complexity barrier; scope unchanged, confidentiality and integrity unaffected, availability impact low.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:39 vuln.today

CVE Published

May 12, 2026 - 19:50 nvd

MEDIUM 5.3

DescriptionCVE.org

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Dependency on Vulnerable Third-Party Component vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Remote denial-of-service in Adobe Commerce, exploitable without authentication, stems from a dependency on a vulnerable third-party component (CWE-1395) that can be triggered to crash the application. Affected releases span a wide version range including 2.4.9-beta1 through 2.4.4-p17 and earlier. No public exploit or CISA KEV listing exists at time of analysis, and the EPSS score of 0.07% places this in the 22nd percentile - reflecting limited observed exploitation interest despite the attack being automatable per the SSVC framework.

Technical ContextAI

CWE-1395 (Dependency on Vulnerable Third-Party Component) indicates that Adobe Commerce incorporates a third-party library or component that itself carries an exploitable flaw, rather than a defect in Adobe's own code. The specific third-party component is not identified in available data. Adobe Commerce (also known as Magento Commerce) is a PHP-based e-commerce platform with a complex dependency tree, making such inherited vulnerabilities structurally common. The CPE string cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:* confirms the vulnerable software family. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L is consistent with a remotely triggerable crash confined to the application layer, with no privilege escalation or data exposure path identified.

RemediationAI

Consult Adobe's security bulletin APSB26-49 at https://helpx.adobe.com/security/products/magento/apsb26-49.html for the vendor-recommended patched release versions - exact fix versions were not independently confirmable from the available input data beyond the advisory reference. Operators running any version in the 2.4.4-p17 through 2.4.8-p4 range or the 2.4.9-beta1 pre-release should prioritize review against the bulletin. As a compensating control while patching is scheduled, deploying a Web Application Firewall (WAF) or rate-limiting rules on endpoints that trigger the vulnerable third-party component may reduce denial-of-service exposure, though the specific component and triggering endpoint are not identified in available data - verify with Adobe before relying on this control. Upgrading to the latest patched release within each maintained branch is the definitive remediation.