What is the CVSS score of CVE-2026-34656?

CVE-2026-34656 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Commerce CVE-2026-34656

EUVD-2026-29765 MEDIUM

Improper Authorization (CWE-285)

2026-05-12 adobe

GHSA-q79h-qrw2-xqrf

Adobe Authentication Bypass Adobe Commerce

4.3

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable with no attacker credentials required (PR:N), but victim interaction is mandatory (UI:R); write impact is limited (I:L) with no confidentiality or availability effect and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:34 vuln.today

CVE Published

May 12, 2026 - 19:50 nvd

MEDIUM 4.3

DescriptionCVE.org

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.

AnalysisAI

Improper authorization in Adobe Commerce allows unauthenticated remote attackers to bypass security controls and achieve unauthorized write access to the affected storefront or backend by luring a victim into visiting a crafted URL or a compromised web page. All supported release lines through versions 2.4.8-p4 and 2.4.9-beta1 are confirmed affected per Adobe Security Bulletin APSB26-49. No public exploit code or active exploitation has been identified at time of analysis; EPSS is 0.03% (8th percentile) and SSVC exploitation status is 'none', placing this in the lower tier of operational urgency despite a network-accessible attack vector.

Technical ContextAI

Adobe Commerce (formerly Magento) is an enterprise e-commerce platform. The flaw is classified as CWE-285 (Improper Authorization), meaning the application fails to correctly enforce access-control decisions for at least one write-capable operation reachable via a network request. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N suggests a CSRF-style or authorization-token-bypass pattern where the server does not validate whether the initiating party is entitled to perform the write action when a request originates from a victim-supplied browser context. The CPE string cpe:2.3:a:adobe:adobe_commerce covers all editions (including Magento Open Source derivatives where applicable). The scope is unchanged (S:U) and impact is limited to integrity (I:L), consistent with a targeted write-bypass rather than a full account or data takeover.

RemediationAI

Apply the patches released by Adobe as documented in Security Bulletin APSB26-49 (https://helpx.adobe.com/security/products/magento/apsb26-49.html), which covers fixes for all affected release lines (2.4.4 through 2.4.9). The exact fixed version numbers are available per the vendor advisory but were not independently confirmed from the input data provided - consult APSB26-49 directly for the authoritative patched build numbers before upgrading. As a compensating control pending patch deployment, configure a web application firewall to restrict or require additional validation on write-capable endpoints susceptible to cross-site request patterns; be aware this may interfere with legitimate customer workflows such as cart updates or account modifications. Restricting administrative and write-sensitive URL paths to known-good IP ranges reduces attack surface with minimal user-experience impact for backend operators.