Adobe Commerce EUVD-2026-44412

Exploitation requires the attacker to already hold a high-privileged Adobe Commerce/Magento account (CVSS PR:H) and network access to the vulnerable admin or API surface of one of the affected editions (Adobe Commerce, Commerce B2B, Magento Open Source, or the Webhooks Plugin). No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once the privileged foothold exists the injection is straightforward. The primary limiting factors are the high-privilege prerequisite - this is not an unauthenticated flaw - and the need for the targeted store to run an affected, unpatched version; deployments that tightly restrict admin accounts and admin-panel network exposure materially reduce exploitability.

The signals are moderate rather than emergency-level. The CVSS 3.1 base score of 7.2 (High) reflects a network vector (AV:N), low complexity (AC:L), no user interaction (UI:N), and full C/I/A impact (H/H/H), but is gated by PR:H - the attacker must already hold high privileges (e.g., an admin or comparably trusted account). This privilege requirement is the dominant limiting factor and substantially lowers real-world risk versus an unauthenticated SQLi. There is no CISA KEV listing (not actively exploited per available data), no POC identified, and no EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified. SSVC inputs (exploitation status, automatable, technical impact) were not provided in the input and are not inferred here. Net: a genuine High-severity issue meriting prompt patching for internet-facing Commerce stores, but the PR:H gate means it is primarily an escalation/insider or post-compromise concern rather than a mass-exploitable unauthenticated bug - verify privilege context against your admin access model.

An attacker who has obtained a high-privileged Adobe Commerce account (for example a compromised admin credential or a malicious insider) submits crafted input to a vulnerable parameter that is concatenated into a backend SQL query. The injected SQL manipulates the database to escalate access or alter application state, ultimately achieving code execution in the current user's context and taking over the account or session. No user interaction and no separate victim action is required; no public POC is currently known.