Adobe Commerce EUVD-2026-44421

Exploitation requires HIGH privileges (CVSS PR:H) - the attacker must already hold an elevated/administrative Adobe Commerce account able to reach the vulnerable output path (the Webhooks Plugin being a distinctly listed affected component points to webhook/output rendering as the likely feature involved). No user interaction is required (UI:N) and the vector is network-reachable (AV:N) with low complexity (AC:L), so once privileged access exists the attack is straightforward. Limiting factors: the PR:H barrier means this is not exploitable by anonymous/unauthenticated internet users against a default install; SSVC marks Exploitation=none and Automatable=no, and there is no public exploit, so realistic risk is confined to insiders or post-compromise scenarios where an admin credential is already controlled.

Signals are mixed and point to lower real-world urgency than the 9.1 base score suggests. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C, C:H/I:H/A:H) shows network reach and total impact but requires HIGH privileges (PR:H) - an already-authenticated admin/elevated account - which is a substantial barrier. SSVC reinforces this: Exploitation=none (no observed activity), Automatable=no (cannot be reliably scripted at scale), Technical Impact=total. EPSS is low (0.90%, 56th percentile), there is no KEV listing and no public exploit identified, so this is not an active, widespread threat. Net: a genuine total-impact RCE worth patching, but the PR:H requirement plus 'none/no' SSVC and low EPSS make it a priority insider/post-compromise risk rather than an internet-facing emergency. Note the scope-change flag implies impact beyond the vulnerable component; the exact downstream reach is not detailed in the source data and should be confirmed with Adobe's advisory.

A malicious or compromised administrator (or an attacker who has phished/hijacked a privileged Commerce back-office account) supplies content that is stored and later emitted without proper escaping - for example through a webhook or template field - causing the server to interpret it as code and execute it in the context of the current user. No victim interaction is needed (UI:N), and the changed scope means the executed code may reach components beyond the original entry point. No public proof-of-concept has been identified at time of analysis.