Adobe Commerce CVE-2026-48412

Exploitation requires the attacker to already possess a high-privilege authenticated account on the Adobe Commerce, Magento Open Source, or Adobe Commerce B2B instance (PR:H) - for example an admin, merchant, or B2B company user with an elevated role. The flaw is an incorrect authorization check (CWE-863) that fails to properly restrict access, allowing that account to reach resources or actions outside its assigned role. No user interaction is needed (UI:N) and the endpoint is network-reachable (AV:N). Limiting factors: the requirement for pre-existing high privileges eliminates unauthenticated and low-privilege attackers, and affected deployments are those running unpatched builds up to the 2026-jul releases (Commerce ≤2.4.9-2026-jul, B2B ≤1.5.3-2026-jul, Magento Open Source ≤2.4.9-2026-jul).

This is a moderate-severity, low-urgency issue best treated as routine patch-cycle work rather than an emergency. The signals are internally consistent and point the same direction: CVSS 3.1 base is 7.2 (High) driven mainly by C:H/I:H/A:H impact, but the exploit prerequisite is PR:H - the attacker must already hold high privileges within the Adobe Commerce admin/merchant context, which sharply narrows the realistic threat population. EPSS is 0.32% (24th percentile), consistent with the CISA SSVC decision framework which reports Exploitation: none, Automatable: no, Technical Impact: partial - three independent low-urgency signals reinforcing each other. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a real-but-low-priority issue rather than an actively exploited threat. One tension worth flagging: the CVSS vector is AV:N (network) and the tag set includes 'Authentication Bypass', which could suggest pre-auth reach, yet the description and CWE-863 (Incorrect Authorization) describe a privilege-escalation-from-existing-high-privilege scenario - the AV:N reflects that the API/web surface is reachable over the network, not that the attacker is unauthenticated. SSVC 'Technical Impact: partial' also mildly contrasts with the vector's triple-High impact, suggesting Adobe/CISA view the escalation as bounded to specific restricted resources rather than full system takeover.

An attacker who already holds a high-privilege account on an Adobe Commerce / Magento store (e.g. a limited-scope admin or B2B company account) sends crafted requests to an endpoint whose authorization check is incorrectly enforced, gaining access to restricted resources or actions beyond their assigned role. No user interaction is required. No public proof-of-concept exploit has been identified at time of analysis.