Adobe Commerce EUVD-2026-99220

Requires an authenticated high-privilege (administrator-level) account on the Adobe Commerce / Magento Open Source / Adobe Commerce B2B application, per PR:H in the CVSS vector. Once that access is held, exploitation is network-reachable (AV:N), low-complexity (AC:L), and requires no user interaction (UI:N), targeting the improperly validated input path to achieve code execution. The primary limiting factor is the high-privilege precondition - this is not exploitable by anonymous or low-privileged users - which confines the realistic attacker set to insiders, holders of compromised admin credentials, or post-authentication attack chains. No special non-default configuration is indicated in the description.

This is a genuine but conditional priority. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H, 8.7 High) shows a network-reachable, low-complexity flaw with no user interaction and a changed scope, which elevates severity - but the decisive limiter is PR:H: an attacker must already hold a high-privilege (administrative) account. That requirement sharply narrows the realistic threat to insiders, compromised admin credentials, or chained attacks, rather than opportunistic mass exploitation. No EPSS score, no CISA KEV listing, and no POC were provided in the input, so there is no signal of active or probable near-term exploitation to contrast against the CVSS score - the elevated rating is driven by impact (I:H/A:H) and scope change, not by observed exploitation. Note the vendor scored C:N (no confidentiality impact) despite describing 'arbitrary code execution,' which is unusual since code execution typically yields confidentiality loss; this should be verified with Adobe. Net: treat as a high-priority patch for internet-facing Commerce admin deployments, but its real-world exploitation likelihood is moderated by the high-privilege precondition.

An attacker who has obtained high-privilege (admin) access to an Adobe Commerce / Magento instance - via stolen credentials, a malicious insider, or a prior compromise - submits crafted input that the application fails to validate properly (CWE-20), causing arbitrary code execution in the context of the current user. Because scope is changed, the impact can extend beyond the vulnerable component to affect other resources on the host. No public exploit was identified at time of analysis, and no user interaction is required.