Adobe Commerce

Incorrect Authorization (CWE-863) in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plugin enables remote unauthenticated attackers to bypass security controls and gain unauthorized read and limited write access to protected resources. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special network position, making it trivially automatable - a finding corroborated by SSVC's Automatable:yes designation. No public exploit or active exploitation has been identified at time of analysis, and EPSS sits at 0.53% (41st percentile), suggesting limited opportunistic exploitation activity despite the high CVSS score.

Incorrect Authorization (CWE-863) in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plugin exposes sensitive data to unauthenticated remote attackers who can bypass security controls to gain unauthorized read access. Exploitation is constrained by high attack complexity - conditions beyond the attacker's control must be satisfied - which aligns with the SSVC assessment of non-automatable exploitation and the low EPSS score of 0.61% (45th percentile). No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog as of analysis date; Adobe has released July 2026 patches across all affected product lines per advisory APSB26-73.

Incorrect Authorization in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Webhooks Plugin allows unauthenticated remote attackers to bypass security controls and gain unauthorized read and limited write access to protected resources. The full product ecosystem is affected across multiple active release lines, with vendor-confirmed July 2026 patches available via APSB26-73. No active exploitation has been confirmed (CISA KEV absent, SSVC exploitation: none), though the SSVC framework flags the attack as automatable - meaning mass scanning tools could trivially target exposed storefronts.

Stored Cross-Site Scripting in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin allows a high-privileged attacker to inject persistent malicious JavaScript into vulnerable admin form fields, which then executes in any victim's browser that navigates to the affected page. Scope change (S:C) is confirmed in the CVSS vector, meaning the injected payload crosses from the Commerce application security boundary into the victim's browser session, enabling session hijacking or credential harvesting. Despite no current KEV listing, the EPSS score sits at the 96th percentile (11.52%), warranting close monitoring even though CISA SSVC currently rates exploitation as none and the attack is not assessed as automatable.

Arbitrary code execution in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin stems from improper output encoding/escaping (CWE-116) and lets a high-privileged attacker run code in the context of the current user with no user interaction. Because the scope is changed, exploitation can affect components beyond the initially vulnerable one, and Adobe rates it CVSS 9.1. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.90%, 56th percentile), so risk is currently theoretical/targeted rather than mass-exploited.

Arbitrary code execution in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plugin lets a remote attacker run script in the context of a victim's authenticated session by abusing an unrestricted file-upload flaw (CWE-434). Because the impact executes in the current user's browser/session context and requires the victim to visit a crafted URL or compromised page, the outcome is account/session takeover and privilege escalation rather than direct server compromise. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the EPSS score of 28.32% (98th percentile) signals meaningfully elevated exploitation likelihood for a newly disclosed flaw.

Incorrect authorization in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin exposes sensitive data to remote unauthenticated attackers who can bypass security controls to gain unauthorized read access. Classified as CWE-863 (Incorrect Authorization), the flaw carries a CVSS 3.1 score of 5.9 with high confidentiality impact but is gated by high attack complexity - exploitation depends on conditions outside the attacker's control. No public exploit has been identified at time of analysis, EPSS stands at 0.61% (45th percentile), and CISA SSVC assesses exploitation as none and not automatable, indicating meaningful barriers to opportunistic mass exploitation.

Open redirect in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin allows remote unauthenticated attackers to construct malicious URLs that silently forward victims to attacker-controlled phishing sites, enabling credential theft and account takeover. The flaw spans the full product family across multiple supported version branches and was disclosed by Adobe via Security Bulletin APSB26-73 with patches released in July 2026. No public exploit code has been identified at time of analysis, and SSVC rates exploitation status as 'none' with EPSS at 0.74% (50th percentile), indicating limited real-world exploitation signal despite broad product prevalence.

Stored cross-site scripting in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin lets a high-privileged authenticated attacker persist malicious JavaScript in form fields that executes in a victim's browser when the affected page is viewed. Because CVSS scope is changed and the payload runs in the victim's authenticated context, an attacker can escalate to takeover of a higher-privileged admin session or account. No public exploit identified at time of analysis; remediated in Adobe security bulletin APSB26-73.

Limited sensitive information disclosure in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plugin enables unauthenticated remote attackers to obtain restricted data under high-complexity conditions. The CWE-200 flaw requires no user interaction but exploitation depends on factors outside attacker control - such as race conditions or specific environmental state - sharply constraining practical exploitation. No active exploitation is confirmed: SSVC rates exploitation as none, EPSS stands at 0.57% (43rd percentile), and the vulnerability is absent from the CISA KEV catalog; Adobe has released July 2026 security patches across all affected product lines via APSB26-73.

Stored XSS in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Commerce Webhooks Plugin enables a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, executing in victims' browsers upon page load. Affected versions span Adobe Commerce through 2.4.9/p-series, Magento Open Source through 2.4.9, B2B through 1.5.3, and Webhooks Plugin through 1.20.0. The CVSS scope change (S:C) indicates the injected script can operate beyond the originating application's security context, raising the practical impact when higher-privileged users such as store administrators visit the compromised page. No public exploit has been identified at time of analysis and CISA has not listed this in KEV.

Security feature bypass in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks plugin allows a high-privileged, authenticated attacker to defeat an authorization check (CWE-863) and gain unauthorized read access to data that should be restricted. The flaw is network-reachable with low complexity, requires no user interaction, and changes scope, so the exposure can reach beyond the initially vulnerable component. There is no public exploit identified at time of analysis and no CISA KEV listing, making exploitation currently theoretical rather than observed.

Stored cross-site scripting in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source lets a low-privileged authenticated attacker persist malicious JavaScript into vulnerable form fields, which then executes in a victim's browser and can escalate to account or session takeover. Because scope is changed (S:C), the injected script runs in a security context beyond the attacker's own privileges - the hallmark of admin-panel or storefront XSS crossing a trust boundary. No public exploit identified at time of analysis, but the 8.7 CVSS and account-takeover impact make this a meaningful priority for e-commerce operators running the affected platforms.

SQL injection in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin allows a high-privileged authenticated attacker to inject malicious SQL that can escalate to arbitrary code execution in the context of the current user, enabling account/session takeover. The flaw (CWE-89) is network-reachable and requires no user interaction, but demands existing high privileges per the CVSS PR:H metric. No public exploit is identified at time of analysis and it is not listed in CISA KEV; EPSS was not provided.

Improper authorization in Adobe Commerce allows unauthenticated remote attackers to bypass security controls and achieve unauthorized write access to the affected storefront or backend by luring a victim into visiting a crafted URL or a compromised web page. All supported release lines through versions 2.4.8-p4 and 2.4.9-beta1 are confirmed affected per Adobe Security Bulletin APSB26-49. No public exploit code or active exploitation has been identified at time of analysis; EPSS is 0.03% (8th percentile) and SSVC exploitation status is 'none', placing this in the lower tier of operational urgency despite a network-accessible attack vector.

Stored Cross-Site Scripting in Adobe Commerce allows a high-privileged attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in any victim's browser upon visiting the affected page. All active release trains from 2.4.4 through 2.4.8 are affected, along with the 2.4.9-beta1 pre-release. No public exploit identified at time of analysis; an EPSS score of 0.02% (5th percentile) and SSVC exploitation status of 'none' confirm negligible current exploitation activity, keeping real-world urgency low despite the stored nature of the flaw.

Application denial-of-service in Adobe Commerce (Magento) affects versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier, where an unauthenticated remote attacker can trigger uncontrolled resource consumption (CWE-400) to exhaust system resources without any user interaction. There is no public exploit identified at time of analysis and the EPSS probability is very low (0.01%, 2nd percentile), so while the CVSS availability impact is High (7.5), real-world weaponization appears unlikely in the near term. Impact is limited to availability, with no confidentiality or integrity effect.

Stored cross-site scripting in Adobe Commerce (Magento) lets a low-privileged authenticated user persist malicious JavaScript into vulnerable form fields, which then executes in the browser of any victim who later views the affected page. Because scope is changed, the injected script can escalate to takeover of the victim's account or session, including higher-privileged admin sessions. No public exploit identified at time of analysis, and EPSS is negligible (0.01%, 2nd percentile), indicating low near-term mass-exploitation likelihood.

Server-Side Request Forgery in Adobe Commerce (Magento) versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets a remote attacker bypass security controls and gain unauthorized read access by luring a victim to a maliciously crafted URL or compromised page. Rated CVSS 7.4 with a scope-changed impact, the flaw affects the e-commerce platform's server-side request handling. There is no public exploit identified at time of analysis, and EPSS is low (0.13%, 32nd percentile), so exploitation is currently theoretical rather than observed.

Improper Input Validation in Adobe Commerce allows a high-privileged attacker to bypass security controls and gain unauthorized write access to the filesystem, with scope change crossing a security boundary. The vulnerability affects versions up to 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17, and 2.4.9-beta1. No public exploit has been identified at time of analysis, and EPSS sits at 0.04% (11th percentile), reflecting negligible real-world exploitation activity despite the scope-changed integrity impact.

Arbitrary file system read and write in Adobe Commerce (Magento) versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets an authenticated administrator escape the intended restricted directory via path traversal, reading or writing files anywhere the web application user has access. Because scope is changed (S:C), the impact can extend beyond the vulnerable component. No public exploit identified at time of analysis, and EPSS is low (0.09%, 26th percentile), consistent with the high-privilege prerequisite.

Denial-of-service in Adobe Commerce (Magento) versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets a remote unauthenticated attacker crash the application by exercising a bundled vulnerable third-party component, taking the storefront offline. The flaw carries CVSS 7.5 with an availability-only impact and no confidentiality or integrity effect; there is no public exploit identified at time of analysis, and EPSS is low at 0.07%. It was reported by Adobe and addressed in security bulletin APSB26-49.

Improper authorization in Adobe Commerce (Magento) 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets a remote unauthenticated attacker (CVSS PR:N) bypass a security control and gain unauthorized write access to the affected system, with no user interaction. There is no public exploit identified at time of analysis and the EPSS score is low (0.09%), but the network-reachable, no-auth, no-interaction vector combined with Adobe's own reporting warrants prompt patching. This is not in CISA KEV and shows no confirmed exploitation.

Application denial-of-service in Adobe Commerce (Magento) affects versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier, where an Uncontrolled Resource Consumption flaw (CWE-400) lets a remote, unauthenticated attacker exhaust server resources without any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/A:H) reflects a high availability impact with no confidentiality or integrity loss. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.01%, 2nd percentile), indicating minimal observed exploitation interest despite the network-reachable attack surface.

Uncontrolled resource consumption in Adobe Commerce (Magento) versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets a remote attacker exhaust system resources and force an application-level denial-of-service without any authentication or user interaction. The flaw carries a CVSS 7.5 (availability-only) rating and, per Adobe's APSB26-49 advisory, affects the e-commerce platform's server-side request handling. There is no public exploit identified at time of analysis and the EPSS score is very low (0.04%, 12th percentile), indicating no observed exploitation activity to date.

Stored Cross-Site Scripting in Adobe Commerce 2.4.x allows a high-privileged attacker to inject persistent JavaScript payloads into vulnerable form fields, which execute in the browser of any user who subsequently views the affected page. The scope change (S:C) means injected scripts run in the victim's browser security context, enabling session hijacking or unauthorized action execution against lower-privileged users. No public exploit code has been identified and EPSS at 0.06% (20th percentile) with SSVC exploitation status of 'none' confirm no current active exploitation.

Remote denial-of-service in Adobe Commerce, exploitable without authentication, stems from a dependency on a vulnerable third-party component (CWE-1395) that can be triggered to crash the application. Affected releases span a wide version range including 2.4.9-beta1 through 2.4.4-p17 and earlier. No public exploit or CISA KEV listing exists at time of analysis, and the EPSS score of 0.07% places this in the 22nd percentile - reflecting limited observed exploitation interest despite the attack being automatable per the SSVC framework.

Denial-of-service in Adobe Commerce (Magento) 2.4.4-p17, 2.4.5-p16, 2.4.6-p14, 2.4.7-p9, 2.4.8-p4, 2.4.9-beta1 and earlier allows a remote attacker to exhaust system resources and render the application unavailable without any authentication or user interaction. The flaw is an Uncontrolled Resource Consumption (CWE-400) issue reported by Adobe (APSB26-49); it carries a CVSS 7.5 (availability-only impact) with no confidentiality or integrity effect. There is no public exploit identified at time of analysis and the EPSS score is very low (0.04%), indicating no observed weaponization to date.

Improper authorization in Adobe Commerce (Magento) lets remote unauthenticated attackers bypass security controls and gain unauthorized write access across builds 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier. The flaw (CWE-863) requires no user interaction and is exploitable over the network per its CVSS:3.1 vector, though there is no public exploit identified at time of analysis and it is not on CISA KEV. EPSS is low (0.09%, 26th percentile), but CISA SSVC marks it 'Automatable: yes', meaning any working exploit could be scaled easily.

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a blind SSRF vulnerability in the bundled dotmailer extension. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the API File Option Upload Extension. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability via the `quoteId` parameter. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the Multishipping Module. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a Path Traversal vulnerability via the `theme[preview_image]` parameter. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability when saving a configurable product. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability that could be abused by an attacker to inject. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability in the customer address upload feature that. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability while saving a customer's details with a. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper Neutralization of Special Elements Used In A Command via the Data collection. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.