Adobe Commerce CVE-2026-48416

No special authentication or privileged position is required: the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against default network-accessible deployments of Adobe Commerce, Magento Open Source, and Adobe Commerce B2B. The specific API endpoint or request pattern that triggers the incorrect authorization check is not disclosed in the available intelligence; exact reproduction conditions should be treated as partially unknown pending vendor clarification in APSB26-92. Limiting factors: exploitation is constrained to read-only data access (I:N, A:N); an attacker cannot modify data or disrupt service via this vulnerability alone. Instances not exposed to the internet (intranet-only deployments) face reduced risk due to network proximity requirements despite AV:N classification.

The CVSS 3.1 base score of 7.5 (High) is well-supported by the vector: network-reachable, low complexity, no privileges required, no user interaction, with high confidentiality impact and no integrity or availability effect. The risk profile is a targeted data-exfiltration scenario rather than a full-compromise one. EPSS data was not provided in the intelligence feed, so exploitation probability cannot be quantified precisely; however, the AC:L/PR:N/UI:N combination means exploitation is automatable and broadly scannable, suggesting real-world risk is non-trivial for any internet-facing deployment - even a mid-sized retail operation running an unpatched instance should treat this as urgent. No KEV listing and no POC are confirmed at time of analysis, which moderates immediate urgency somewhat, but the wide affected version range (six Commerce branches, four Magento branches, five B2B branches) means the attack surface is large. The absence of integrity or availability impact (I:N, A:N) caps the worst-case to unauthorized data disclosure rather than store takeover or data destruction.

An unauthenticated attacker sends crafted HTTP requests to a publicly accessible Adobe Commerce or Magento storefront endpoint, exploiting the incorrect authorization logic to bypass the access check. The attacker then reads protected data - such as customer records, order details, or configuration information - without supplying credentials. No public exploit code has been confirmed at time of analysis, but the low attack complexity means techniques could be developed through black-box fuzzing of authorization-sensitive endpoints.