What is the CVSS score of CVE-2026-34685?

CVE-2026-34685 has a CVSS 3.1 base score of 3.4 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Commerce CVE-2026-34685

EUVD-2026-29780 LOW

Improper Input Validation (CWE-20)

2026-05-12 adobe

GHSA-9pv2-pw69-q562

Adobe Authentication Bypass Adobe Commerce

3.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

3.4 LOW

AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N

vuln.today AI

3.4 LOW

High privileges (PR:H) and mandatory user interaction (UI:R) are confirmed prerequisites; scope change (S:C) reflects cross-boundary integrity write; no confidentiality or availability impact is indicated.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:36 vuln.today

CVE Published

May 12, 2026 - 19:50 nvd

LOW 3.4

DescriptionCVE.org

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier [NEEDS REVIEW: impact mismatch - ticket says 'Arbitrary file system write', CIA triad derives 'Security Feature Bypass'. Verify CVSS vector before publishing.] are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

AnalysisAI

Improper Input Validation in Adobe Commerce allows a high-privileged attacker to bypass security controls and gain unauthorized write access to the filesystem, with scope change crossing a security boundary. The vulnerability affects versions up to 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17, and 2.4.9-beta1. No public exploit has been identified at time of analysis, and EPSS sits at 0.04% (11th percentile), reflecting negligible real-world exploitation activity despite the scope-changed integrity impact.

Technical ContextAI

Adobe Commerce (formerly Magento), identified via CPE cpe:2.3:a:adobe:adobe_commerce, is a widely deployed PHP-based e-commerce platform. CWE-20 (Improper Input Validation) as the root cause indicates that user-supplied or attacker-controlled input is insufficiently sanitized or validated before being processed, allowing the application's security filtering logic to be circumvented. The CVSS vector's S:C (Changed Scope) metric signals that the vulnerability crosses a security boundary - the exploitable component and the impacted component are distinct, consistent with a bypass that propagates write access into a protected subsystem or storage layer. The internal ticket note flagging an impact mismatch between 'Arbitrary file system write' and 'Security Feature Bypass' suggests the root behavior may be a write primitive that is obscured by the classification as a bypass; both interpretations are plausible given the I:L integrity impact in the CVSS vector.

RemediationAI

Upgrade to the patched release corresponding to your branch as specified in Adobe security bulletin APSB26-49 (https://helpx.adobe.com/security/products/magento/apsb26-49.html); no independently confirmed fixed version numbers are available from the provided input data beyond the advisory reference itself - consult APSB26-49 directly for exact target versions. As a compensating control where immediate patching is not possible, restrict admin panel access to trusted IP ranges to reduce the high-privilege account exposure surface, and enforce multi-factor authentication on all administrator accounts to raise the bar for attacker prerequisites. Since user interaction is required (UI:R), additional monitoring on admin-generated URLs shared externally can serve as a detection layer. Note that these controls do not eliminate the vulnerability - they reduce the probability of the preconditions being met.