What is the CVSS score of CVE-2026-47997?

CVE-2026-47997 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.6%.

Adobe Commerce CVE-2026-47997

EUVD-2026-44424 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-14 adobe

GHSA-7j9c-xv2p-xcr6

Adobe Authentication Bypass Adobe Commerce Adobe Commerce B2B Magento Open Source Adobe Commerce Webhooks Plugin

5.9

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

Network-accessible with no auth required, but AC:H reflects state-dependent conditions; impact is read-only, so I:N and A:N apply.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 14:39 vuln.today

CVE Published

Jul 14, 2026 - 19:44 cve.org

MEDIUM 5.9

DescriptionCVE.org

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

AnalysisAI

Incorrect Authorization (CWE-863) in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plugin exposes sensitive data to unauthenticated remote attackers who can bypass security controls to gain unauthorized read access. Exploitation is constrained by high attack complexity - conditions beyond the attacker's control must be satisfied - which aligns with the SSVC assessment of non-automatable exploitation and the low EPSS score of 0.61% (45th percentile). No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog as of analysis date; Adobe has released July 2026 patches across all affected product lines per advisory APSB26-73.

Technical ContextAI

Adobe Commerce (formerly Magento) is a PHP-based e-commerce platform with extensive authorization and access-control layers governing storefront and admin operations. CWE-863 (Incorrect Authorization) indicates that the application performs an authorization check but implements it incorrectly, allowing a request that should be denied to proceed - distinct from missing authorization (CWE-862). The flaw spans four CPE-confirmed products: cpe:2.3:a:adobe:adobe_commerce, cpe:2.3:a:adobe:adobe_commerce_b2b, cpe:2.3:a:adobe:magento_open_source, and cpe:2.3:a:adobe:adobe_commerce_webhooks_plugin. The Webhooks Plugin component suggests the flaw may intersect with event-driven integration pathways, though the exact vulnerable code path is not disclosed in public data. The scope is limited to confidentiality (C:H, I:N, A:N), meaning the authorization logic controls a read pathway rather than a write or execution pathway.

RemediationAI

Apply the July 2026 security patches released by Adobe per advisory APSB26-73 (https://helpx.adobe.com/security/products/magento/apsb26-73.html). For Adobe Commerce, apply the 2026-jul patch releases corresponding to your branch: 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, or 2.4.4-2026-jul. For Adobe Commerce B2B, apply 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, or 1.3.3-2026-jul as appropriate. For Magento Open Source, apply 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, or 2.4.6-2026-jul. For the Adobe Commerce Webhooks Plugin, upgrade to version 1.21.0. No vendor-documented workaround is available in public disclosures; if patching is delayed, restricting access to Webhooks Plugin endpoints at the WAF or reverse-proxy layer, and tightening network exposure of the Commerce admin and API surfaces, may reduce the attack surface - though these mitigations do not eliminate the authorization flaw and carry the side effect of disrupting legitimate integration traffic.