Adobe Commerce CVE-2026-34685

Exploitation requires the attacker to already hold a high-privileged account within the Adobe Commerce instance (PR:H), such as an administrator role with access to generate or share application URLs. A second prerequisite is victim-side user interaction: a distinct person must actively visit a maliciously crafted URL or interact with a compromised web page (UI:R). The vulnerable Adobe Commerce installation must be network-accessible (AV:N). Non-default or specialized configuration is not explicitly required beyond standard platform operation, but the combination of PR:H and UI:R substantially limits the attack surface to insider-threat scenarios or accounts compromised through credential theft. Exploitation is not automatable per SSVC, ruling out scripted mass attacks. Versions earlier than the patched releases listed in APSB26-49 are the limiting factor - patched deployments are not affected.

Despite the Changed Scope designation, the overall risk is low-to-moderate. CVSS base score is 3.4, severely attenuated by PR:H (high-privileged attacker required) and UI:R (victim must interact with a malicious URL). EPSS at 0.04% (11th percentile) aligns with SSVC's 'Exploitation: none' classification, confirming no observed exploitation activity. The vulnerability is not automatable (SSVC: Automatable: no), which eliminates mass-exploitation scenarios. Technical Impact is rated 'partial' by SSVC, consistent with the limited I:L integrity outcome. The primary real-world risk is an insider threat or compromised admin account being leveraged to stage a social-engineering step against another user to achieve write access - a multi-step, low-probability chain. A critical data quality flag is embedded in the NVD description itself: an impact mismatch between 'Arbitrary file system write' (from the originating ticket) and 'Security Feature Bypass' (derived from the CIA triad) has not been publicly reconciled. Until Adobe clarifies this discrepancy via the APSB26-49 advisory, the exact blast radius of the write primitive remains uncertain.

A malicious or compromised Adobe Commerce administrator crafts a URL containing malformed input that bypasses the platform's input validation filters. The attacker social-engineers a second user - such as another admin or a customer service representative - into visiting the link. When the victim loads the URL in their browser session, the crafted input triggers a security boundary crossing that grants the attacker's payload unauthorized write access to a protected filesystem location.