What is the CVSS score of CVE-2026-47998?

CVE-2026-47998 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.6%.

Adobe Commerce CVE-2026-47998

EUVD-2026-44419 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-14 adobe

GHSA-24hm-fc95-562h

Authentication Bypass Adobe Adobe Commerce Magento Open Source Adobe Commerce B2B Adobe Commerce Webhooks Plugin

5.9

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

Network reachable, no auth required, but AC:H because exploitation depends on uncontrollable runtime conditions; impact is confidentiality only.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 14:40 vuln.today

CVE Published

Jul 14, 2026 - 19:44 cve.org

MEDIUM 5.9

DescriptionCVE.org

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

AnalysisAI

Incorrect authorization in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin exposes sensitive data to remote unauthenticated attackers who can bypass security controls to gain unauthorized read access. Classified as CWE-863 (Incorrect Authorization), the flaw carries a CVSS 3.1 score of 5.9 with high confidentiality impact but is gated by high attack complexity - exploitation depends on conditions outside the attacker's control. No public exploit has been identified at time of analysis, EPSS stands at 0.61% (45th percentile), and CISA SSVC assesses exploitation as none and not automatable, indicating meaningful barriers to opportunistic mass exploitation.

Technical ContextAI

Adobe Commerce (formerly Magento Commerce) and its open-source sibling Magento Open Source are PHP-based e-commerce platforms widely used for online storefronts and B2B procurement portals. The vulnerability is rooted in CWE-863 (Incorrect Authorization), which occurs when an application fails to verify that an actor is authorized to access a particular resource or perform an action - distinct from authentication failures (CWE-287). In this case, the authorization logic governing read access to protected resources can be bypassed under specific runtime conditions. The scope includes the Adobe Commerce Webhooks Plugin (≤1.20.0), suggesting the flaw may touch the event/webhook subsystem that facilitates integrations with third-party services. Affected CPEs span cpe:2.3:a:adobe:adobe_commerce, cpe:2.3:a:adobe:adobe_commerce_b2b, cpe:2.3:a:adobe:magento_open_source, and cpe:2.3:a:adobe:adobe_commerce_webhooks_plugin, confirming broad surface across Adobe's commerce product family.

RemediationAI

Vendor-released patches are available for all affected product lines as of July 2026. Adobe Commerce operators should apply the 2026-jul patch release corresponding to their installed branch: 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, or 2.4.4-2026-jul. Adobe Commerce B2B administrators should apply the corresponding July 2026 patches: 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, or 1.3.3-2026-jul. Magento Open Source users should apply the 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, or 2.4.6-2026-jul release as appropriate. The Adobe Commerce Webhooks Plugin should be upgraded to version 1.21.0 or later. Full patch guidance is published in Adobe Security Bulletin APSB26-73 at https://helpx.adobe.com/security/products/magento/apsb26-73.html. If immediate patching is not feasible, compensating controls should focus on network-level access restrictions - limiting exposure of the Commerce API and webhook endpoints to known IP ranges - and enhanced audit logging of read operations on sensitive resources to detect unauthorized access attempts. Disabling the Webhooks Plugin integration temporarily reduces the plugin-specific attack surface at the cost of breaking third-party integration flows.