What is the CVSS score of CVE-2026-47984?

CVE-2026-47984 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.5%.

Which versions of Adobe Commerce are affected by CVE-2026-47984?

Adobe Commerce and Magento Open Source contain an unauthenticated authorization bypass (CVE-2026-47984, CVSS 8.2) allowing remote attackers to read and modify protected resources without…

How to fix or mitigate CVE-2026-47984?

Within 24 hours: inventory all systems running Adobe Commerce, Magento Open Source, or the Commerce Webhooks Plugin; verify internet accessibility of affected instances; enable comprehensive audit logging for authentication failures and data access events. Within 7 days: deploy Web Application Firewall rules to block authorization bypass attempts targeting these products; implement network segmentation restricting API endpoint access to known trusted networks only; enforce API rate limiting on sensitive endpoints; disable the Webhooks Plugin if not operationally required. Within 30 days: establish continuous monitoring for Adobe security advisories; evaluate feasibility and timeline for platform upgrades to patched releases when available; implement IP-based access controls on all admin and API endpoints; conduct forensic audit of data accessed during exposure period.

Adobe Commerce CVE-2026-47984

EUVD-2026-44425 HIGH

Incorrect Authorization (CWE-863)

2026-07-14 adobe

GHSA-c8v3-r7gc-jmx8

Authentication Bypass Adobe Adobe Commerce Adobe Commerce B2B Magento Open Source Adobe Commerce Webhooks Plugin

8.2

CVSS 3.1 · NVD

Severity by source

Vendor (adobe) PRIMARY

HIGH

qualitative

NVD

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Network-reachable with no prerequisites confirmed by description; high confidentiality and low integrity match the read-heavy, limited-write authorization bypass impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Updated

Aug 05, 2026 - 17:49 vuln.today

v3 (cvss_changed)

Severity Changed

Aug 05, 2026 - 17:37 NVD

CRITICAL HIGH

CVSS changed

Aug 05, 2026 - 17:37 NVD

9.1 (CRITICAL) 8.2 (HIGH)

Analysis Updated

Jul 15, 2026 - 15:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 15, 2026 - 15:52 vuln.today

cvss_changed

Severity Changed

Jul 15, 2026 - 15:52 NVD

HIGH CRITICAL

CVSS changed

Jul 15, 2026 - 15:52 NVD

8.2 (HIGH) 9.1 (CRITICAL)

Analysis Generated

Jul 14, 2026 - 21:00 vuln.today

CVE Published

Jul 14, 2026 - 19:44 nvd

HIGH 8.2

DescriptionNVD

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction.

AnalysisAI

Incorrect Authorization (CWE-863) in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plugin enables remote unauthenticated attackers to bypass security controls and gain unauthorized read and limited write access to protected resources. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special network position, making it trivially automatable - a finding corroborated by SSVC's Automatable:yes designation. No public exploit or active exploitation has been identified at time of analysis, and EPSS sits at 0.53% (41st percentile), suggesting limited opportunistic exploitation activity despite the high CVSS score.

Technical ContextAI

CWE-863 (Incorrect Authorization) indicates the application fails to properly verify that a requesting party has the appropriate permissions for a resource or operation - distinct from authentication bypass (CWE-287), which concerns identity verification. In Adobe Commerce and its Magento Open Source codebase, authorization logic governs access to catalog data, order data, customer records, and administrative endpoints. The flaw spans four distinct CPE entries: cpe:2.3:a:adobe:adobe_commerce, cpe:2.3:a:adobe:adobe_commerce_b2b, cpe:2.3:a:adobe:magento_open_source, and cpe:2.3:a:adobe:adobe_commerce_webhooks_plugin, indicating the authorization defect may reside in shared framework code or an API layer consumed by all four components. The Webhooks Plugin scope is notable as webhooks-enabled merchants expose additional API surface that could be leveraged through the bypass.

RemediationAI

Adobe has released patched versions for all affected product lines, documented in advisory APSB26-73 at https://helpx.adobe.com/security/products/magento/apsb26-73.html. For Adobe Commerce, upgrade to the July 2026 security patches: 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, or 2.4.4-2026-jul depending on your installed branch. For Magento Open Source, apply 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, or 2.4.6-2026-jul. For Adobe Commerce B2B, upgrade to 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, or 1.3.3-2026-jul as appropriate. For the Adobe Commerce Webhooks Plugin, upgrade to version 1.21.0. If immediate patching is not possible for internet-facing instances, consider placing a Web Application Firewall in front of the Commerce API and storefront endpoints to inspect and rate-limit requests to authorization-sensitive routes; note this is a compensating control only and does not eliminate the underlying flaw.