Adobe Commerce EUVD-2026-74031

No special conditions are required for exploitation - CVSS PR:N/UI:N confirms unauthenticated exploitation with no user interaction against any network-exposed Adobe Commerce or Magento Open Source installation running an affected version. The scope change (S:C) indicates that read access crosses a security boundary into adjacent components beyond the directly vulnerable module, but this is an outcome of exploitation rather than a prerequisite. Exploitation is limited to read access only; no write, execution, or availability impact is possible through this flaw alone. Limiting factors include: only versions prior to the August 2026 patch series are affected; installations protected by a WAF or placed behind an authenticated reverse proxy or VPN have reduced direct exposure; and the exact triggering endpoint within the Commerce application is not publicly disclosed at time of analysis, which modestly raises practical exploitation difficulty.

The CVSS 8.6 score is driven primarily by the scope change (S:C) combined with high confidentiality impact, network accessibility, zero authentication requirement, and no user interaction - a combination that elevates the score despite the impact being read-only. SSVC characterizes exploitation as 'none' at time of analysis (no confirmed active exploitation), but rates the vulnerability as automatable with partial technical impact, meaning scripted mass-scanning against unpatched deployments is feasible and likely once vulnerability details circulate. The confidentiality-only impact (I:N/A:N) bounds the worst-case outcome to data exposure rather than service disruption or code execution, but in an e-commerce context this translates directly to customer PII, payment-related configuration, order records, and internal system data - all high-value intelligence targets. Even a mid-sized municipal IT team in swidnica running a Magento Open Source storefront on an unpatched 2.4.x branch should treat this as urgent given the zero-authentication threshold and automation potential. EPSS data is not available in the provided intelligence, so quantitative exploitation probability cannot be stated; however, the SSVC automatable rating and the broad deployment footprint of Adobe Commerce collectively warrant expedited patching.

An unauthenticated attacker sends crafted HTTP requests - likely targeting a Commerce REST API or GraphQL endpoint protected by an authorization gate - exploiting the incorrect authorization check to retrieve sensitive data such as customer records, order history, B2B pricing data, or internal configuration values. Because the vulnerability is automatable per SSVC and requires no credentials or user interaction, a threat actor could deploy scanning infrastructure to enumerate unpatched Adobe Commerce instances across the internet and bulk-extract data from vulnerable storefronts at scale.