Adobe Commerce CVE-2026-48001

No authentication is required (PR:N confirmed by CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) and no user interaction is needed (UI:N confirmed). However, exploitation is explicitly conditioned on factors outside the attacker's control (AC:H): the CVE description states 'Exploit depends on conditions beyond the attacker's control,' indicating the attack succeeds only when specific runtime state, timing, or environmental prerequisites align - not on demand. This condition limits automated, scalable exploitation, which SSVC independently confirms as Automatable: no. The impact ceiling is limited confidentiality disclosure (C:L); there is no integrity or availability impact. Exploitation is further constrained to unpatched versions of Adobe Commerce through 2.4.9, Magento Open Source through 2.4.9, Adobe Commerce B2B through 1.5.3, and Adobe Commerce Webhooks Plugin through 1.20.0. The specific nature of the triggering condition - whether a race window, load-dependent state, or another environmental factor - is not disclosed in the available data.

All aggregate risk signals consistently point to a low-priority finding. The CVSS base score of 3.7 (Low) is driven by AV:N (network-accessible) but sharply limited by AC:H (conditions beyond attacker control), S:U (no scope change), and C:L (only limited confidentiality impact with no integrity or availability consequence). EPSS of 0.57% at the 43rd percentile places this CVE near the median of all tracked vulnerabilities - not elevated. SSVC independently confirms Exploitation: none, Automatable: no, and Technical Impact: partial, reinforcing that this is not a candidate for emergency response. The vulnerability is absent from the CISA KEV catalog and no public exploit code has been identified. The combination of high attack complexity, limited impact scope, and complete absence of observed exploitation makes this a routine patch-cycle priority rather than an urgent operational risk. No conflicting signals are present - all source data aligns on low real-world priority.

An unauthenticated remote attacker targeting an exposed Adobe Commerce storefront sends crafted network requests timed to coincide with a specific high-complexity server-side condition - such as a race window or transient configuration state - causing the application to leak limited sensitive information in its response. Because no public exploit code has been identified and the attack requires conditions beyond attacker control, successful exploitation would demand repeated probing or precise timing coordination rather than simple automated enumeration, consistent with the SSVC Automatable: no assessment. The practical value of any disclosed data is further constrained by the limited (C:L) impact scope defined in the CVSS vector.