What is the CVSS score of CVE-2026-47992?

CVE-2026-47992 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 19.6%.

Which versions of Adobe Commerce are affected by CVE-2026-47992?

SQL injection in Adobe Commerce, Magento Open Source, and the Adobe Commerce Webhooks Plugin allows authenticated high-privilege users to execute arbitrary code and hijack sessions, creating…

How to fix or mitigate CVE-2026-47992?

Within 24 hours, audit administrative account activity for SQL injection attempts and immediately restrict high-privilege access to essential personnel only. Within 7 days, deploy Web Application Firewall rules to block SQL injection patterns against Adobe Commerce databases, enable comprehensive logging of all administrative SQL queries, and segment affected systems to restricted networks where operational feasibility allows. Within 30 days, monitor Adobe's security advisories for patch availability, establish a staged deployment plan when released, and conduct a privilege access review to enforce least-privilege principles across all administrative roles.

Adobe Commerce CVE-2026-47992

EUVD-2026-44412 HIGH

SQL Injection (CWE-89)

2026-07-14 adobe

GHSA-8fv4-5rv7-73qx

SQLi RCE Adobe Adobe Commerce Adobe Commerce B2B Magento Open Source Adobe Commerce Webhooks Plugin

7.2

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable SQLi with low complexity and no user interaction, but requires a high-privilege admin account (PR:H); full C/I/A impact via injection leading to code execution.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 20:59 vuln.today

CVE Published

Jul 14, 2026 - 19:44 nvd

HIGH 7.2

DescriptionCVE.org

Adobe Commerce is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could exploit this vulnerability to execute malicious SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction.

AnalysisAI

SQL injection in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin allows a high-privileged authenticated attacker to inject malicious SQL that can escalate to arbitrary code execution in the context of the current user, enabling account/session takeover. The flaw (CWE-89) is network-reachable and requires no user interaction, but demands existing high privileges per the CVSS PR:H metric. No public exploit is identified at time of analysis and it is not listed in CISA KEV; EPSS was not provided.

Technical ContextAI

The affected software is Adobe's Magento-based e-commerce stack - Adobe Commerce, its B2B extension, the open-source Magento Open Source edition, and the Adobe Commerce Webhooks Plugin (per the four CPE strings cpe:2.3:a:adobe:adobe_commerce, adobe_commerce_b2b, magento_open_source, and adobe_commerce_webhooks_plugin). The root cause is CWE-89, Improper Neutralization of Special Elements used in an SQL Command, meaning user-controllable input is concatenated into a database query without proper parameterization or escaping. Because Magento executes against a MySQL/MariaDB backend and exposes a large authenticated admin and API surface, an injectable query can be abused not only to read/modify data but, as Adobe states, to reach arbitrary code execution in the current user's context - likely by leveraging database-driven configuration, serialized data, or admin functionality that feeds back into application logic.

RemediationAI

Apply the security update referenced in Adobe's bulletin APSB26-73 (https://helpx.adobe.com/security/products/magento/apsb26-73.html); the input did not include an exact fixed version, so consult that advisory for the precise patched build for your edition and apply it as the primary fix - Patch available per vendor advisory. Until patched, reduce exposure by restricting and hardening high-privileged access, since exploitation requires PR:H: enforce strong authentication and MFA on the Magento admin, minimize the number of admin/high-privilege accounts, and restrict admin panel and webhook endpoints by IP allowlisting or VPN (trade-off: may block legitimate remote admins and third-party integrations). Review and limit the Adobe Commerce Webhooks Plugin if not required, and place a WAF in front of the store with SQL-injection rules covering admin and API paths (trade-off: signature-based rules can be bypassed and may cause false positives, so treat this as interim only). Audit database and admin logs for anomalous queries or privilege changes as a detection compensating control.