Adobe Commerce CVE-2026-47984

No special conditions are required for exploitation. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against default configurations of Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plugin. Exploitation is limited by scope (S:U), meaning a successful attacker cannot pivot to the underlying host or other systems - impact is confined to the Commerce application itself. Confidentiality impact is high (C:H) while integrity impact is low (I:L), suggesting read access to sensitive data is achievable but write capability is constrained. Instances not directly reachable from the internet (e.g., behind authenticated VPN or IP allowlist) are not exposed to remote exploitation.

CVSS scores this 8.2 High with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, reflecting network-exploitable, low-complexity, unauthenticated access with high confidentiality and low integrity impact. However, EPSS at 0.53% (41st percentile) signals very limited observed exploitation activity in the wild, well below the threshold that typically indicates active campaigns. SSVC characterizes exploitation as 'none' and technical impact as 'partial', which partially tempers the urgency implied by the CVSS base score. The automatable:yes SSVC designation is the most actionable risk signal here - it confirms that exploitation can be scripted and run at scale across internet-facing Commerce deployments without human-in-the-loop steps, making mass scanning likely once a public exploit emerges. No KEV listing and no POC exist at time of analysis, so the current practical risk is moderate, but the combination of a wide attack surface (multiple products, many version branches), zero prerequisite conditions, and automatable exploitation means this should be treated as high priority for internet-facing storefronts.

An unauthenticated remote attacker sends specially crafted HTTP requests to a publicly accessible Adobe Commerce or Magento Open Source API or storefront endpoint, triggering the authorization logic flaw to bypass access controls. The attacker reads sensitive data such as customer PII, order records, or catalog configuration, and may issue limited write operations to modify data within the scope of the bypassed resource. No public exploit code currently exists, but the automatable nature of the attack means a threat actor could develop a scanner targeting vulnerable storefronts at scale once exploit details are disclosed.