Adobe Commerce EUVD-2026-74033

No special configuration or user interaction is required - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against default-configured instances of Adobe Commerce 2.4.4 through 2.4.9 (August 2026 patch level), Adobe Commerce B2B 1.3.3 through 1.5.3, and Magento Open Source 2.4.4 through 2.4.9. The affected instance must be network-reachable by the attacker - typically satisfied by any internet-facing storefront. The specific endpoint or feature responsible for the authorization failure is not disclosed in available intelligence, so exploitation requires the attacker to identify the vulnerable route, which is the primary limiting factor. Impact is limited to confidentiality (C:H, I:N, A:N), meaning data modification and availability disruption are not achievable through this path alone.

The CVSS 7.5 score reflects a genuinely impactful vulnerability: network-reachable, low complexity, no privileges required, no user interaction, and high confidentiality impact - a combination that is immediately actionable for any defender. The I:N and A:N metrics confirm the flaw is a read-path issue only, limiting blast radius compared to a full RCE, but C:H on an e-commerce platform means the attacker can potentially read customer PII, payment references, order history, or administrative configuration. No EPSS data was supplied and the CVE is not currently listed in CISA KEV, so no confirmed active exploitation is known; however, the low attack complexity and absence of a privilege prerequisite mean exploitation is straightforward once the vulnerable endpoint is identified, and even a mid-sized municipal IT team in gniezno running an Adobe Commerce storefront should treat this as urgent patching rather than a deferred backlog item. The 'Authentication Bypass' tag in the metadata is a slight overstatement - CWE-863 describes authorization-layer failure rather than authentication circumvention - but the practical outcome is similar: an unauthenticated actor reads protected data. The absence of a POC and KEV listing moderates immediate urgency slightly, but the breadth of affected versions (all supported 2.4.x releases) and the prominence of Adobe Commerce in enterprise e-commerce deployments raise the aggregate risk.

An unauthenticated attacker sends a crafted HTTP request to an Adobe Commerce API or web endpoint that performs an authorization check but applies incorrect logic, allowing the request to be processed as if it were authorized at a higher privilege level. The server returns sensitive data - such as customer records, order details, administrative configuration, or B2B contract pricing - that is normally restricted to authenticated merchant or admin roles. No public exploit code is known, but the low complexity of the attack vector means a threat actor who identifies the vulnerable endpoint through documentation review or fuzzing could replicate exploitation without specialized tooling.