What is the CVSS score of CVE-2026-48001?

CVE-2026-48001 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.6%.

Adobe Commerce CVE-2026-48001

EUVD-2026-44416 LOW

Information Exposure (CWE-200)

2026-07-14 adobe

GHSA-g5c4-8grh-gwp6

Information Disclosure Adobe Adobe Commerce Adobe Commerce B2B Magento Open Source Adobe Commerce Webhooks Plugin

3.7

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.7 LOW

Network-reachable with no authentication or user interaction required, but AC:H because exploitation depends on uncontrollable runtime conditions; impact is strictly limited confidentiality with no integrity or availability consequence.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 14:41 vuln.today

CVE Published

Jul 14, 2026 - 19:44 cve.org

LOW 3.7

DescriptionCVE.org

Adobe Commerce is affected by an Information Exposure vulnerability that could lead to a limited disclosure of sensitive information. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

AnalysisAI

Limited sensitive information disclosure in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plugin enables unauthenticated remote attackers to obtain restricted data under high-complexity conditions. The CWE-200 flaw requires no user interaction but exploitation depends on factors outside attacker control - such as race conditions or specific environmental state - sharply constraining practical exploitation. No active exploitation is confirmed: SSVC rates exploitation as none, EPSS stands at 0.57% (43rd percentile), and the vulnerability is absent from the CISA KEV catalog; Adobe has released July 2026 security patches across all affected product lines via APSB26-73.

Technical ContextAI

CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) describes a root cause where an application inadvertently reveals data through its responses, error messages, or observable behavior to parties lacking authorization. The CPE data identifies four affected products: cpe:2.3:a:adobe:adobe_commerce, cpe:2.3:a:adobe:adobe_commerce_b2b, cpe:2.3:a:adobe:magento_open_source, and cpe:2.3:a:adobe:adobe_commerce_webhooks_plugin. Adobe Commerce and Magento Open Source are PHP-based e-commerce platforms built on the Magento codebase; the B2B extension adds business-to-business purchasing workflows, while the Webhooks Plugin provides event-driven integration capabilities. The CVSS AC:H rating indicates the disclosure is contingent on specific runtime conditions - such as a timing window, a particular server state, or an environmental prerequisite - that are not reliably reproducible by an attacker on demand, which is consistent with the description's explicit statement that exploitation depends on conditions beyond attacker control.

RemediationAI

Apply the July 2026 security patches released by Adobe as documented in advisory APSB26-73 (https://helpx.adobe.com/security/products/magento/apsb26-73.html). For Adobe Commerce, upgrade to 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, or 2.4.4-2026-jul depending on your installed version branch. For Magento Open Source, apply 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, or 2.4.6-2026-jul. For Adobe Commerce B2B, apply 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, or 1.3.3-2026-jul. For the Adobe Commerce Webhooks Plugin, upgrade to version 1.21.0. No vendor-documented workarounds are available; given patch availability and the low severity, upgrading through the standard release channel is the complete and preferred remediation path. Organizations on extended support branches should verify patch applicability with Adobe directly.