Adobe Commerce CVE-2026-95630

Requires an authenticated low-privilege account on the Adobe Commerce / Magento Open Source / Adobe Commerce B2B instance (CVSS PR:L), consistent with the description's 'low-privileged attacker'; no user interaction is needed (UI:N) and the attack is network-reachable (AV:N). The description does not name a specific feature, protocol, or non-default configuration setting as a prerequisite, so the primary limiting factor is the need for prior authenticated access - fully anonymous, unauthenticated exploitation is not supported by the CVSS vector. Impact is limited to unauthorized read access (C:L) with no integrity or availability effect.

This is a moderate-severity, lower-priority issue (CVSS 4.3) rather than an urgent threat. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates network-reachable, low-complexity exploitation but requires low-level privileges (PR:L) - i.e., an authenticated account on the Commerce instance - and yields only limited confidentiality impact (C:L) with no integrity or availability impact. No EPSS score, KEV listing, or SSVC decision data was provided in the input, and no public exploit is identified, so there is no signal of active or probable exploitation. The practical risk is unauthorized read access to information the attacker should not see, scoped to an attacker who already holds some authenticated access. This is a real but low-priority defect: patch in the normal cycle, prioritizing instances that grant low-trust user accounts (e.g., B2B company users, customer/registered accounts). Note the 'Authentication Bypass' tag appears to overstate impact - the CVSS PR:L and the description ('low-privileged attacker') indicate a security-feature bypass by an already-authenticated low-privilege user, not a true pre-authentication bypass; treat the tag with caution.

A low-privileged authenticated user (such as a registered customer or B2B company account) sends crafted requests that exploit improper input validation to defeat a security control and read data they should not be authorized to access. Exploitation requires no user interaction and no elevated privileges beyond the attacker's existing low-level account. No public proof-of-concept is identified at this time.