Adobe Commerce CVE-2026-48000

Exploitation requires active user interaction - a victim must click a malicious link crafted by the attacker (UI:R per CVSS vector). The attacker requires no authentication against the target store (PR:N) and no special server-side configuration is needed beyond a default installation of an affected product version. The attack is limited by the mandatory human interaction step, which prevents automated mass exploitation (corroborated by SSVC Automatable: no). Successful exploitation further depends on the attacker's ability to deliver the crafted URL to a target user through phishing, spam, or social media, and on the victim not scrutinizing the redirect destination. The redirect flaw affects all four listed product lines (Adobe Commerce, Adobe Commerce B2B, Magento Open Source, Adobe Commerce Webhooks Plugin) - no non-default feature flag or special deployment mode is indicated as a prerequisite.

The CVSS base score of 6.1 (Medium) is driven primarily by the Changed Scope and the dual C:L/I:L impact, which reflects credential phishing potential rather than direct server compromise. EPSS at 0.74% at the 50th percentile is consistent with a medium-severity web flaw with no confirmed in-the-wild activity. SSVC independently corroborates this: Exploitation is 'none', the attack is not automatable (requiring a human click per UI:R), and technical impact is rated 'partial'. The absence of a CISA KEV listing and no reported POC further support a lower-urgency posture for most organizations. However, the business context of e-commerce must be weighed: credential theft on Adobe Commerce installations has direct financial consequences through account takeover fraud and potential access to stored payment methods or order history. AC:L and PR:N mean the attack itself requires minimal sophistication once a victim is socially engineered. No conflicting signals were detected - CVSS, EPSS, and SSVC are internally consistent.

An attacker registers a convincing phishing domain mimicking an Adobe Commerce storefront login or checkout page, then crafts a URL on the legitimate store that embeds the phishing domain in an unvalidated redirect parameter. The attacker distributes this URL via phishing email or social engineering, and a victim clicks the link - the store's server processes it and redirects the browser to the attacker's site, where the victim submits their credentials believing they are on the authentic store. No public proof-of-concept has been identified at time of analysis, but the technique requires no specialized tooling beyond a hosting environment and social engineering capability.