Adobe Commerce CVE-2026-47997

The CVSS vector (PR:N) confirms no authentication is required to attempt exploitation. However, the AC:H metric and the description's explicit statement that 'exploit depends on conditions beyond the attacker's control' impose a concrete barrier: the attacker must passively satisfy a state-dependent prerequisite - likely a specific application state, timing window, or race condition - that cannot be reliably forced or automated. The SSVC 'automatable: no' assessment corroborates this. Exploitation is further bounded to deployments running one of the affected product lines (Adobe Commerce, Magento Open Source, Adobe Commerce B2B, or Adobe Commerce Webhooks Plugin) at vulnerable version levels. No user interaction is required (UI:N). The scope of impact is limited to read access (C:H, I:N, A:N), so integrity and availability are not at risk. The specific internal condition that must be met is not disclosed in public advisory data.

The CVSS 3.1 base score of 5.9 (Medium) reflects a genuine tension between high network reach (AV:N, PR:N, UI:N) and high attack complexity (AC:H). Real-world risk is further moderated by three converging signals: the EPSS score of 0.61% places this in the 45th percentile - below average exploitation likelihood among all CVEs - the SSVC framework confirms exploitation status as 'none' and automatable as 'no', and the CISA KEV catalog does not list this CVE. Together these signals suggest that while the vulnerability is theoretically exploitable without authentication over the network, the AC:H constraint creates a meaningful barrier: attackers must align exploitation with conditions outside their direct control (such as a specific race condition, session state, or configuration timing). The impact is bounded to confidentiality - no integrity or availability exposure - further reducing operational blast radius. This is a medium-severity issue warranting prompt patching within normal patch cycles but does not represent an emergency requiring out-of-band response in most environments. The involvement of the B2B and Webhooks Plugin components may elevate risk in merchant environments with complex integrations, as those surfaces tend to handle sensitive customer and order data.

An unauthenticated remote attacker targets an internet-exposed Adobe Commerce storefront or API endpoint and crafts requests that exploit the authorization logic flaw under specific timing or state conditions outside the attacker's direct control - consistent with the AC:H designation. When those conditions are met, the authorization check incorrectly permits the request, exposing sensitive commerce data such as customer records, order details, or B2B account information. No public exploit code exists at time of analysis, meaning exploitation requires independent vulnerability research to identify the precise triggering conditions.