Adobe Commerce CVE-2026-48411

Exploitation requires the attacker to already hold high-privilege credentials within the Adobe Commerce or Magento Open Source administrator interface, consistent with CVSS PR:H - unauthenticated users and low-privileged accounts cannot exploit this flaw. The attack is delivered over the network (AV:N) against the Commerce admin panel; local system access is not required. No user interaction from a secondary victim is needed once the attacker is authenticated (UI:N). No special non-default configuration flag or specific platform feature has been documented as a prerequisite - the flaw resides in the core authorization logic accessible to any high-privileged admin account across the affected version ranges. The primary limiting factor is the PR:H requirement, which restricts exploitation to actors who have already succeeded in credential compromise at the administrator tier.

The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H yields a base score of 6.5. The PR:H requirement substantially constrains the realistic attacker pool - exploitation is limited to actors who already hold elevated Commerce administrator credentials, which is not a condition found in default internet exposure. Attack complexity is low and no user interaction is required, meaning that once credentials are obtained, no additional hurdles exist. No EPSS data was provided, so exploitation probability cannot be quantified. The absence of a KEV listing and no identified POC code together suggest no confirmed widespread or active exploitation at time of analysis. The high integrity and availability impact scores indicate that a credential-compromised admin account chained with this flaw could cause damage well beyond what that credential alone would normally authorize. The primary real-world risk scenario involves environments with multiple admin-level users, shared admin accounts, or where a phishing or credential-stuffing attack has already yielded high-privilege access.

A threat actor who has obtained high-privilege Adobe Commerce administrator credentials - through phishing, credential stuffing, or a prior compromise - authenticates to the Commerce admin panel and crafts requests targeting resources or configuration endpoints that their admin role should not be authorized to modify. By exploiting the incorrect authorization logic (CWE-863), the attacker successfully writes to those restricted resources, potentially altering product catalog data, customer records, payment configurations, or platform settings in ways that could also disrupt service availability. No public exploit code has been identified, meaning this currently requires specific knowledge of the authorization bypass pathway.