What is the CVSS score of CVE-2026-47988?

CVE-2026-47988 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.5%.

How to fix or mitigate CVE-2026-47988?

Within 24 hours: Immediately inventory all Adobe Commerce, Magento, and webhook instances; confirm version numbers against affected releases; deploy Web Application Firewall (WAF) rules to block exploitation attempts on authorization endpoints. Within 7 days: Implement additional authentication controls and API rate limiting; enable comprehensive access logging with real-time alerts for unauthorized access attempts; restrict network access to vulnerable storefronts. Within 30 days: Conduct security assessment of authorization mechanisms; review access logs for exploitation evidence; establish procedures for immediate patch deployment when vendor releases updates.

Adobe Commerce CVE-2026-47988

EUVD-2026-44423 HIGH

Incorrect Authorization (CWE-863)

2026-07-14 adobe

GHSA-5pcm-62qr-xhc5

Authentication Bypass Adobe Adobe Commerce Adobe Commerce B2B Magento Open Source Adobe Commerce Webhooks Plugin

8.6

CVSS 3.1 · NVD

Severity by source

Vendor (adobe) PRIMARY

HIGH

qualitative

NVD

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

vuln.today AI

8.6 HIGH

Network-reachable unauthenticated bypass (AV:N/PR:N/AC:L) with high read impact and limited write/availability impact; scope unchanged as exploitation stays within the Commerce application.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Aug 05, 2026 - 17:51 vuln.today

v3 (cvss_changed)

Severity Changed

Aug 05, 2026 - 17:37 NVD

CRITICAL HIGH

CVSS changed

Aug 05, 2026 - 17:37 NVD

9.1 (CRITICAL) 8.6 (HIGH)

Analysis Updated

Jul 15, 2026 - 15:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 15, 2026 - 15:37 vuln.today

cvss_changed

Severity Changed

Jul 15, 2026 - 15:37 NVD

HIGH CRITICAL

CVSS changed

Jul 15, 2026 - 15:37 NVD

8.6 (HIGH) 9.1 (CRITICAL)

Analysis Generated

Jul 14, 2026 - 21:00 vuln.today

CVE Published

Jul 14, 2026 - 19:44 nvd

HIGH 8.6

DescriptionNVD

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction.

AnalysisAI

Incorrect Authorization in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Webhooks Plugin allows unauthenticated remote attackers to bypass security controls and gain unauthorized read and limited write access to protected resources. The full product ecosystem is affected across multiple active release lines, with vendor-confirmed July 2026 patches available via APSB26-73. No active exploitation has been confirmed (CISA KEV absent, SSVC exploitation: none), though the SSVC framework flags the attack as automatable - meaning mass scanning tools could trivially target exposed storefronts.

Technical ContextAI

CWE-863 (Incorrect Authorization) indicates the software performs an authorization check but does so incorrectly - the access control logic fails to properly verify that the requesting party holds sufficient privilege for the requested operation, allowing policy bypass rather than a missing check entirely. The affected surface spans four CPE-identified products: the core Adobe Commerce platform (cpe:2.3:a:adobe:adobe_commerce), the B2B extension (cpe:2.3:a:adobe:adobe_commerce_b2b), the open-source Magento fork (cpe:2.3:a:adobe:magento_open_source), and the Adobe Commerce Webhooks Plugin (cpe:2.3:a:adobe:adobe_commerce_webhooks_plugin). Adobe Commerce and Magento Open Source are PHP-based e-commerce platforms; the B2B module extends them with business purchasing workflows, and the Webhooks Plugin enables outbound event integrations. The breadth of affected components suggests the flaw resides in a shared authorization layer used across the platform.

RemediationAI

Apply the July 2026 security patches released by Adobe per advisory APSB26-73 (https://helpx.adobe.com/security/products/magento/apsb26-73.html). For Adobe Commerce, apply the 2026-jul patch releases targeting your installed branch (2.4.4-2026-jul through 2.4.9-2026-jul). For Magento Open Source, apply the corresponding 2026-jul patch for your branch (2.4.6-2026-jul through 2.4.9-2026-jul). For Adobe Commerce B2B, apply the branch-specific 2026-jul patch (1.3.3-2026-jul through 1.5.3-2026-jul). For the Webhooks Plugin, upgrade to version 1.21.0. If immediate patching is not feasible, consider restricting network access to the Commerce admin panel and any API endpoints at the perimeter - note this may impact legitimate integrations and B2B buyer portal access. Web application firewall rules targeting anomalous authorization bypass patterns may provide partial coverage but are not a substitute for patching given the automatable nature of the attack.