What is the CVSS score of CVE-2026-47996?

CVE-2026-47996 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 18.5%.

Which versions of Adobe Commerce are affected by CVE-2026-47996?

A flaw in Adobe Commerce and Magento Open Source allows authenticated administrators to bypass authorization controls and access customer data beyond their intended permissions.

How to fix or mitigate CVE-2026-47996?

Within 24 hours, inventory all instances of Adobe Commerce, Adobe Commerce B2B, and Magento Open Source running in your environment and document their versions; disable the Webhooks plugin if not actively required; audit administrative users and revoke unnecessary access, retaining only essential admin accounts. Within 7 days, enable comprehensive audit logging and alerting on all administrative functions and API access; establish monitoring baselines for data access patterns to detect anomalous activity; implement network-level access restrictions (IP whitelisting, VPN requirements) for administrative interfaces. Within 30 days, track Adobe security advisories for patch availability; conduct a detailed security review of your administrative roles and data access controls to refine privilege scope; develop an upgrade timeline for transitioning to patched versions once released.

Adobe Commerce CVE-2026-47996

EUVD-2026-44414 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-14 adobe

GHSA-q859-ffv8-vcmh

Authentication Bypass Adobe Adobe Commerce Adobe Commerce B2B Magento Open Source Adobe Commerce Webhooks Plugin

6.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.8 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.6 HIGH

Network-reachable but requires an existing high-privilege account (PR:H) with low complexity and no user interaction; incorrect authorization yields high confidentiality read impact with scope change and minor availability effect, no integrity impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:L/SC:L/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Jul 15, 2026 - 14:37 NVD

HIGH MEDIUM

CVSS changed

Jul 15, 2026 - 14:37 NVD

7.6 (HIGH) 6.8 (MEDIUM)

Analysis Generated

Jul 14, 2026 - 20:58 vuln.today

CVE Published

Jul 14, 2026 - 19:44 nvd

HIGH 7.6

DescriptionCVE.org

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. Scope is changed.

AnalysisAI

Security feature bypass in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks plugin allows a high-privileged, authenticated attacker to defeat an authorization check (CWE-863) and gain unauthorized read access to data that should be restricted. The flaw is network-reachable with low complexity, requires no user interaction, and changes scope, so the exposure can reach beyond the initially vulnerable component. There is no public exploit identified at time of analysis and no CISA KEV listing, making exploitation currently theoretical rather than observed.

Technical ContextAI

Adobe Commerce (formerly Magento Commerce), its B2B extension, the open-source Magento distribution, and the Webhooks plugin share a common PHP-based application core and authorization model. The root cause is CWE-863 (Incorrect Authorization): an access-control decision is evaluated incorrectly, so an actor who already holds elevated privileges is granted read access to resources the authorization logic should have denied. The affected CPEs - cpe:2.3:a:adobe:adobe_commerce, cpe:2.3:a:adobe:adobe_commerce_b2b, cpe:2.3:a:adobe:magento_open_source, and cpe:2.3:a:adobe:adobe_commerce_webhooks_plugin - indicate the weakness lives in shared platform code rather than in a single edition. Incorrect-authorization defects of this kind typically stem from a missing or flawed permission/ACL check on an endpoint, resource, or admin function, allowing a privilege level that passes the initial gate to reach data outside its intended boundary.

RemediationAI

Apply the fixes described in Adobe security bulletin APSB26-73 (https://helpx.adobe.com/security/products/magento/apsb26-73.html); Patch available per vendor advisory, though an exact fixed version number is not present in the supplied data and must be taken directly from that bulletin for each edition (Adobe Commerce, Adobe Commerce B2B, Magento Open Source) and for the Webhooks plugin - do not assume a version not stated there. Until patching completes, reduce exposure by tightening the pool of high-privilege and admin accounts that could trigger the flaw: review and minimize administrative role assignments, enforce least privilege and strong authentication (MFA) on the admin panel, and restrict admin-panel network reachability to trusted IP ranges or VPN so the PR:H prerequisite is harder to satisfy - the trade-off is that IP allow-listing can disrupt legitimate remote administrators and must be paired with a break-glass path. Add detective monitoring of admin and API activity for anomalous read access to sensitive resources.