Adobe Commerce
Monthly
Arbitrary code execution in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source is reachable by an attacker who already holds a high-privilege administrator-level account, exploiting an improperly validated input path to run code in the context of the current user with no victim interaction required. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) rates confidentiality, integrity, and availability impact as high with a changed scope, meaning the effect is not contained within the vulnerable component; the governing limitation is the PR:H precondition, which keeps the realistic attacker set to insiders, holders of compromised admin credentials, or post-authentication attack chains rather than anonymous or low-privileged users. No public exploit code was identified and there is no confirmed active exploitation (CISA KEV) at time of analysis, so this should be treated as a high-value post-authentication target rather than an opportunistically exploited one.
Unauthenticated remote code execution affects Adobe Commerce, Adobe Commerce B2B, and Magento Open Source through improper neutralization of special elements used in a template engine (CWE-1336, server-side template injection). Per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C), an attacker can reach the vulnerable template-processing surface over the network without credentials and without any victim interaction, and the scope change (S:C) indicates compromise can extend beyond the vulnerable component into the surrounding account or session context. The score is the maximum possible (10.0) and Adobe has published remediation guidance in APSB26-153; no public exploit code or confirmed active exploitation was identified at time of analysis, so the risk is driven by severity and ease of reachability rather than observed attacks.
Incorrect authorization in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source lets remote, unauthenticated attackers bypass security controls to gain unauthorized read access plus limited write access, with no user interaction required. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (base 7.2) confirms the attacker needs no credentials and only network reachability to an affected, unpatched instance - typically an internet-facing storefront, REST/GraphQL API, or admin interface - while the changed scope (S:C) indicates the bypass can reach resources outside the vulnerable component's own security boundary. Impact is bounded rather than catastrophic: confidentiality and integrity are Low and availability is None, so this is a security-feature/authorization bypass rather than full administrative takeover or data destruction, and no public exploit code has been identified at time of analysis, making this a genuine but mid-tier priority.
Stored cross-site scripting (XSS) in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows an attacker who can write to a vulnerable form field to persist malicious JavaScript that executes in a victim's browser when that page is rendered, potentially hijacking an admin or shopper session and gaining elevated access or control over the victim's account. The vendor vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, 9.3 Critical) is driven by the scope change and high confidentiality/integrity impact, but the attack is not self-contained: it requires a second victim (UI:R) to browse the page that renders the payload, and our independent assessment assumes a low-privileged writer account (PR:L) rather than the vendor's unauthenticated (PR:N) reading, which must be confirmed against APSB26-153. No CISA KEV entry and no public exploit code were identified at time of analysis; availability is unaffected (A:N), so impact is bounded to the confidentiality and integrity of the victim's session and account data.
Arbitrary code execution is achievable in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source by an attacker who already holds a high-privilege backend account, exploiting an improper input validation flaw (CWE-20) that a single crafted, network-delivered request can trigger without any user interaction. The CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects complete compromise of confidentiality, integrity, and availability with a changed scope, but the PR:H metric means the attacker must first obtain administrative or equivalently privileged credentials - stolen admin or API credentials, or a pre-existing privileged foothold. Adobe reported the issue directly (APSB26-153); no public exploit code has been identified and there is no confirmed active exploitation (not in CISA KEV) at time of analysis, so the practical risk is concentrated in organizations whose admin panels are internet-exposed with weak credential controls.
Stored cross-site scripting in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows a high-privileged backend user to persist malicious JavaScript into vulnerable admin form fields, which then executes in the browser of any other user who views the affected page, potentially hijacking that victim's account or session. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N, 8.1 High) requires the attacker to already hold a high-privileged backend account (PR:H) and requires a second victim to browse the poisoned page (UI:R); no unauthenticated or low-privilege entry path exists, so this is primarily an insider-abuse or post-compromise escalation vector. There is no public exploit code identified at time of analysis, and despite the High base score our assessment puts real-world priority at medium-to-moderate rather than emergency, with vendor fixes described in Adobe bulletin APSB26-153.
Incorrect authorization checks in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allow a low-privileged authenticated user - such as a registered customer or a limited back-office/B2B account - to bypass security controls and gain unauthorized read and write access, with a limited impact on availability (CVSS 8.3, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L). No administrative role and no victim user interaction are required, so any internet-facing storefront or admin surface exposing the vulnerable authorization check is in scope; the practical gating factor is possession of some valid credential, and stores permitting open customer or B2B self-registration lower that bar considerably. At time of analysis there is no CISA KEV listing and no public exploit identified, and no EPSS score was supplied; the root cause is classified as CWE-863 (Incorrect Authorization) and Adobe has published advisory APSB26-153, which should be treated as the authoritative source for affected and fixed versions.
Remote, low-complexity code execution is possible in Adobe Commerce, Adobe Commerce B2B and Magento Open Source through an incorrect authorization flaw (CWE-863) rated CVSS 9.8, allowing an attacker to act with the privileges of the current request context and escalate to arbitrary code execution without user interaction. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes network-reachable exploitation requiring no prior privileges, which is the strongest signal in the available data. No public exploit code and no CISA KEV entry were identified at time of analysis, and Adobe's only provided reference is advisory APSB26-153; defenders should note Adobe's wording about 'the context of the current user,' which may indicate an existing session or request context is required even though the vector claims PR:N.
Stored cross-site scripting in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows a remote attacker to place persistent JavaScript into a vulnerable form field, which then executes in the browser of any user who browses to the page rendering that field - per the vendor vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N (9.3), the injection step is unauthenticated, but the victim must subsequently visit the affected page, so this cannot fire fully automatically. Because the scope is changed (S:C) and confidentiality and integrity impacts are both High, a successful exploit can cross a trust boundary and yield session or account control over the victim rather than merely degrading the page, though availability is unaffected. There is no confirmed active exploitation (the issue is not in CISA KEV) and no public exploit identified at time of analysis; no EPSS score was supplied with this dataset, so that signal is unavailable.
Stored cross-site scripting (XSS) in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows an authenticated low-privileged attacker to inject malicious JavaScript into vulnerable form fields, which then executes in a victim's browser when they view the affected page. The flaw carries a vendor CVSS 3.1 score of 8.7 (CWE-79) and requires victim interaction; no public exploit or active exploitation is identified at time of analysis. Successful exploitation can lead to theft of session tokens or account manipulation for the victim user.
Server-side template injection in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows remote unauthenticated attackers to execute arbitrary code by injecting special elements into the template engine (CWE-1336). Rated CVSS 10.0 with a changed scope, the flaw requires no user interaction and grants code execution in the context of the current user, per Adobe advisory APSB26-146. No public exploit has been identified at time of analysis, but the maximal score and unauthenticated network reach make this a top-priority patch for e-commerce operators.
Incorrect Authorization (CWE-863) in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plugin enables remote unauthenticated attackers to bypass security controls and gain unauthorized read and limited write access to protected resources. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special network position, making it trivially automatable - a finding corroborated by SSVC's Automatable:yes designation. No public exploit or active exploitation has been identified at time of analysis, and EPSS sits at 0.53% (41st percentile), suggesting limited opportunistic exploitation activity despite the high CVSS score.
Incorrect Authorization in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Webhooks Plugin allows unauthenticated remote attackers to bypass security controls and gain unauthorized read and limited write access to protected resources. The full product ecosystem is affected across multiple active release lines, with vendor-confirmed July 2026 patches available via APSB26-73. No active exploitation has been confirmed (CISA KEV absent, SSVC exploitation: none), though the SSVC framework flags the attack as automatable - meaning mass scanning tools could trivially target exposed storefronts.
Arbitrary code execution in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin stems from improper output encoding/escaping (CWE-116) and lets a high-privileged attacker run code in the context of the current user with no user interaction. Because the scope is changed, exploitation can affect components beyond the initially vulnerable one, and Adobe rates it CVSS 9.1. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.90%, 56th percentile), so risk is currently theoretical/targeted rather than mass-exploited.
Arbitrary code execution in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plugin lets a remote attacker run script in the context of a victim's authenticated session by abusing an unrestricted file-upload flaw (CWE-434). Because the impact executes in the current user's browser/session context and requires the victim to visit a crafted URL or compromised page, the outcome is account/session takeover and privilege escalation rather than direct server compromise. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the EPSS score of 28.32% (98th percentile) signals meaningfully elevated exploitation likelihood for a newly disclosed flaw.
Stored cross-site scripting in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin lets a high-privileged authenticated attacker persist malicious JavaScript in form fields that executes in a victim's browser when the affected page is viewed. Because CVSS scope is changed and the payload runs in the victim's authenticated context, an attacker can escalate to takeover of a higher-privileged admin session or account. No public exploit identified at time of analysis; remediated in Adobe security bulletin APSB26-73.
Stored cross-site scripting in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source lets a low-privileged authenticated attacker persist malicious JavaScript into vulnerable form fields, which then executes in a victim's browser and can escalate to account or session takeover. Because scope is changed (S:C), the injected script runs in a security context beyond the attacker's own privileges - the hallmark of admin-panel or storefront XSS crossing a trust boundary. No public exploit identified at time of analysis, but the 8.7 CVSS and account-takeover impact make this a meaningful priority for e-commerce operators running the affected platforms.
SQL injection in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin allows a high-privileged authenticated attacker to inject malicious SQL that can escalate to arbitrary code execution in the context of the current user, enabling account/session takeover. The flaw (CWE-89) is network-reachable and requires no user interaction, but demands existing high privileges per the CVSS PR:H metric. No public exploit is identified at time of analysis and it is not listed in CISA KEV; EPSS was not provided.
Application denial-of-service in Adobe Commerce (Magento) affects versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier, where an unauthenticated remote attacker can trigger uncontrolled resource consumption (CWE-400) to exhaust system resources without any user interaction. There is no public exploit identified at time of analysis and the EPSS probability is very low (0.01%, 2nd percentile), so while the CVSS availability impact is High (7.5), real-world weaponization appears unlikely in the near term. Impact is limited to availability, with no confidentiality or integrity effect.
Stored cross-site scripting in Adobe Commerce (Magento) lets a low-privileged authenticated user persist malicious JavaScript into vulnerable form fields, which then executes in the browser of any victim who later views the affected page. Because scope is changed, the injected script can escalate to takeover of the victim's account or session, including higher-privileged admin sessions. No public exploit identified at time of analysis, and EPSS is negligible (0.01%, 2nd percentile), indicating low near-term mass-exploitation likelihood.
Server-Side Request Forgery in Adobe Commerce (Magento) versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets a remote attacker bypass security controls and gain unauthorized read access by luring a victim to a maliciously crafted URL or compromised page. Rated CVSS 7.4 with a scope-changed impact, the flaw affects the e-commerce platform's server-side request handling. There is no public exploit identified at time of analysis, and EPSS is low (0.13%, 32nd percentile), so exploitation is currently theoretical rather than observed.
Arbitrary file system read and write in Adobe Commerce (Magento) versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets an authenticated administrator escape the intended restricted directory via path traversal, reading or writing files anywhere the web application user has access. Because scope is changed (S:C), the impact can extend beyond the vulnerable component. No public exploit identified at time of analysis, and EPSS is low (0.09%, 26th percentile), consistent with the high-privilege prerequisite.
Denial-of-service in Adobe Commerce (Magento) versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets a remote unauthenticated attacker crash the application by exercising a bundled vulnerable third-party component, taking the storefront offline. The flaw carries CVSS 7.5 with an availability-only impact and no confidentiality or integrity effect; there is no public exploit identified at time of analysis, and EPSS is low at 0.07%. It was reported by Adobe and addressed in security bulletin APSB26-49.
Improper authorization in Adobe Commerce (Magento) 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets a remote unauthenticated attacker (CVSS PR:N) bypass a security control and gain unauthorized write access to the affected system, with no user interaction. There is no public exploit identified at time of analysis and the EPSS score is low (0.09%), but the network-reachable, no-auth, no-interaction vector combined with Adobe's own reporting warrants prompt patching. This is not in CISA KEV and shows no confirmed exploitation.
Application denial-of-service in Adobe Commerce (Magento) affects versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier, where an Uncontrolled Resource Consumption flaw (CWE-400) lets a remote, unauthenticated attacker exhaust server resources without any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/A:H) reflects a high availability impact with no confidentiality or integrity loss. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.01%, 2nd percentile), indicating minimal observed exploitation interest despite the network-reachable attack surface.
Uncontrolled resource consumption in Adobe Commerce (Magento) versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets a remote attacker exhaust system resources and force an application-level denial-of-service without any authentication or user interaction. The flaw carries a CVSS 7.5 (availability-only) rating and, per Adobe's APSB26-49 advisory, affects the e-commerce platform's server-side request handling. There is no public exploit identified at time of analysis and the EPSS score is very low (0.04%, 12th percentile), indicating no observed exploitation activity to date.
Denial-of-service in Adobe Commerce (Magento) 2.4.4-p17, 2.4.5-p16, 2.4.6-p14, 2.4.7-p9, 2.4.8-p4, 2.4.9-beta1 and earlier allows a remote attacker to exhaust system resources and render the application unavailable without any authentication or user interaction. The flaw is an Uncontrolled Resource Consumption (CWE-400) issue reported by Adobe (APSB26-49); it carries a CVSS 7.5 (availability-only impact) with no confidentiality or integrity effect. There is no public exploit identified at time of analysis and the EPSS score is very low (0.04%), indicating no observed weaponization to date.
Improper authorization in Adobe Commerce (Magento) lets remote unauthenticated attackers bypass security controls and gain unauthorized write access across builds 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier. The flaw (CWE-863) requires no user interaction and is exploitable over the network per its CVSS:3.1 vector, though there is no public exploit identified at time of analysis and it is not on CISA KEV. EPSS is low (0.09%, 26th percentile), but CISA SSVC marks it 'Automatable: yes', meaning any working exploit could be scaled easily.
Adobe Commerce, along with Magento Open Source and Adobe Commerce B2B, contains an improper input validation vulnerability that allows an authenticated low-privilege attacker to bypass security features and gain unauthorized read access. The flaw is network-reachable, requires no user interaction, and is limited to confidentiality impact (read-only) with a CVSS score of 4.3, making it a moderate-severity, lower-priority issue. No public exploit code or confirmed active exploitation has been identified in the available intelligence.
Incorrect Authorization (CWE-863) in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plugin exposes sensitive data to unauthenticated remote attackers who can bypass security controls to gain unauthorized read access. Exploitation is constrained by high attack complexity - conditions beyond the attacker's control must be satisfied - which aligns with the SSVC assessment of non-automatable exploitation and the low EPSS score of 0.61% (45th percentile). No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog as of analysis date; Adobe has released July 2026 patches across all affected product lines per advisory APSB26-73.
Stored Cross-Site Scripting in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin allows a high-privileged attacker to inject persistent malicious JavaScript into vulnerable admin form fields, which then executes in any victim's browser that navigates to the affected page. Scope change (S:C) is confirmed in the CVSS vector, meaning the injected payload crosses from the Commerce application security boundary into the victim's browser session, enabling session hijacking or credential harvesting. Despite no current KEV listing, the EPSS score sits at the 96th percentile (11.52%), warranting close monitoring even though CISA SSVC currently rates exploitation as none and the attack is not assessed as automatable.
Incorrect authorization in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin exposes sensitive data to remote unauthenticated attackers who can bypass security controls to gain unauthorized read access. Classified as CWE-863 (Incorrect Authorization), the flaw carries a CVSS 3.1 score of 5.9 with high confidentiality impact but is gated by high attack complexity - exploitation depends on conditions outside the attacker's control. No public exploit has been identified at time of analysis, EPSS stands at 0.61% (45th percentile), and CISA SSVC assesses exploitation as none and not automatable, indicating meaningful barriers to opportunistic mass exploitation.
Open redirect in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin allows remote unauthenticated attackers to construct malicious URLs that silently forward victims to attacker-controlled phishing sites, enabling credential theft and account takeover. The flaw spans the full product family across multiple supported version branches and was disclosed by Adobe via Security Bulletin APSB26-73 with patches released in July 2026. No public exploit code has been identified at time of analysis, and SSVC rates exploitation status as 'none' with EPSS at 0.74% (50th percentile), indicating limited real-world exploitation signal despite broad product prevalence.
Limited sensitive information disclosure in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plugin enables unauthenticated remote attackers to obtain restricted data under high-complexity conditions. The CWE-200 flaw requires no user interaction but exploitation depends on factors outside attacker control - such as race conditions or specific environmental state - sharply constraining practical exploitation. No active exploitation is confirmed: SSVC rates exploitation as none, EPSS stands at 0.57% (43rd percentile), and the vulnerability is absent from the CISA KEV catalog; Adobe has released July 2026 security patches across all affected product lines via APSB26-73.
Stored XSS in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Commerce Webhooks Plugin enables a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, executing in victims' browsers upon page load. Affected versions span Adobe Commerce through 2.4.9/p-series, Magento Open Source through 2.4.9, B2B through 1.5.3, and Webhooks Plugin through 1.20.0. The CVSS scope change (S:C) indicates the injected script can operate beyond the originating application's security context, raising the practical impact when higher-privileged users such as store administrators visit the compromised page. No public exploit has been identified at time of analysis and CISA has not listed this in KEV.
Security feature bypass in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks plugin allows a high-privileged, authenticated attacker to defeat an authorization check (CWE-863) and gain unauthorized read access to data that should be restricted. The flaw is network-reachable with low complexity, requires no user interaction, and changes scope, so the exposure can reach beyond the initially vulnerable component. There is no public exploit identified at time of analysis and no CISA KEV listing, making exploitation currently theoretical rather than observed.
Improper authorization in Adobe Commerce allows unauthenticated remote attackers to bypass security controls and achieve unauthorized write access to the affected storefront or backend by luring a victim into visiting a crafted URL or a compromised web page. All supported release lines through versions 2.4.8-p4 and 2.4.9-beta1 are confirmed affected per Adobe Security Bulletin APSB26-49. No public exploit code or active exploitation has been identified at time of analysis; EPSS is 0.03% (8th percentile) and SSVC exploitation status is 'none', placing this in the lower tier of operational urgency despite a network-accessible attack vector.
Stored Cross-Site Scripting in Adobe Commerce allows a high-privileged attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in any victim's browser upon visiting the affected page. All active release trains from 2.4.4 through 2.4.8 are affected, along with the 2.4.9-beta1 pre-release. No public exploit identified at time of analysis; an EPSS score of 0.02% (5th percentile) and SSVC exploitation status of 'none' confirm negligible current exploitation activity, keeping real-world urgency low despite the stored nature of the flaw.
Improper Input Validation in Adobe Commerce allows a high-privileged attacker to bypass security controls and gain unauthorized write access to the filesystem, with scope change crossing a security boundary. The vulnerability affects versions up to 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17, and 2.4.9-beta1. No public exploit has been identified at time of analysis, and EPSS sits at 0.04% (11th percentile), reflecting negligible real-world exploitation activity despite the scope-changed integrity impact.
Stored Cross-Site Scripting in Adobe Commerce 2.4.x allows a high-privileged attacker to inject persistent JavaScript payloads into vulnerable form fields, which execute in the browser of any user who subsequently views the affected page. The scope change (S:C) means injected scripts run in the victim's browser security context, enabling session hijacking or unauthorized action execution against lower-privileged users. No public exploit code has been identified and EPSS at 0.06% (20th percentile) with SSVC exploitation status of 'none' confirm no current active exploitation.
Remote denial-of-service in Adobe Commerce, exploitable without authentication, stems from a dependency on a vulnerable third-party component (CWE-1395) that can be triggered to crash the application. Affected releases span a wide version range including 2.4.9-beta1 through 2.4.4-p17 and earlier. No public exploit or CISA KEV listing exists at time of analysis, and the EPSS score of 0.07% places this in the 22nd percentile - reflecting limited observed exploitation interest despite the attack being automatable per the SSVC framework.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a blind SSRF vulnerability in the bundled dotmailer extension. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the API File Option Upload Extension. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability via the `quoteId` parameter. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the Multishipping Module. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a Path Traversal vulnerability via the `theme[preview_image]` parameter. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability when saving a configurable product. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability that could be abused by an attacker to inject. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability in the customer address upload feature that. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability while saving a customer's details with a. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper Neutralization of Special Elements Used In A Command via the Data collection. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Arbitrary code execution in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source is reachable by an attacker who already holds a high-privilege administrator-level account, exploiting an improperly validated input path to run code in the context of the current user with no victim interaction required. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) rates confidentiality, integrity, and availability impact as high with a changed scope, meaning the effect is not contained within the vulnerable component; the governing limitation is the PR:H precondition, which keeps the realistic attacker set to insiders, holders of compromised admin credentials, or post-authentication attack chains rather than anonymous or low-privileged users. No public exploit code was identified and there is no confirmed active exploitation (CISA KEV) at time of analysis, so this should be treated as a high-value post-authentication target rather than an opportunistically exploited one.
Unauthenticated remote code execution affects Adobe Commerce, Adobe Commerce B2B, and Magento Open Source through improper neutralization of special elements used in a template engine (CWE-1336, server-side template injection). Per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C), an attacker can reach the vulnerable template-processing surface over the network without credentials and without any victim interaction, and the scope change (S:C) indicates compromise can extend beyond the vulnerable component into the surrounding account or session context. The score is the maximum possible (10.0) and Adobe has published remediation guidance in APSB26-153; no public exploit code or confirmed active exploitation was identified at time of analysis, so the risk is driven by severity and ease of reachability rather than observed attacks.
Incorrect authorization in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source lets remote, unauthenticated attackers bypass security controls to gain unauthorized read access plus limited write access, with no user interaction required. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (base 7.2) confirms the attacker needs no credentials and only network reachability to an affected, unpatched instance - typically an internet-facing storefront, REST/GraphQL API, or admin interface - while the changed scope (S:C) indicates the bypass can reach resources outside the vulnerable component's own security boundary. Impact is bounded rather than catastrophic: confidentiality and integrity are Low and availability is None, so this is a security-feature/authorization bypass rather than full administrative takeover or data destruction, and no public exploit code has been identified at time of analysis, making this a genuine but mid-tier priority.
Stored cross-site scripting (XSS) in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows an attacker who can write to a vulnerable form field to persist malicious JavaScript that executes in a victim's browser when that page is rendered, potentially hijacking an admin or shopper session and gaining elevated access or control over the victim's account. The vendor vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, 9.3 Critical) is driven by the scope change and high confidentiality/integrity impact, but the attack is not self-contained: it requires a second victim (UI:R) to browse the page that renders the payload, and our independent assessment assumes a low-privileged writer account (PR:L) rather than the vendor's unauthenticated (PR:N) reading, which must be confirmed against APSB26-153. No CISA KEV entry and no public exploit code were identified at time of analysis; availability is unaffected (A:N), so impact is bounded to the confidentiality and integrity of the victim's session and account data.
Arbitrary code execution is achievable in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source by an attacker who already holds a high-privilege backend account, exploiting an improper input validation flaw (CWE-20) that a single crafted, network-delivered request can trigger without any user interaction. The CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects complete compromise of confidentiality, integrity, and availability with a changed scope, but the PR:H metric means the attacker must first obtain administrative or equivalently privileged credentials - stolen admin or API credentials, or a pre-existing privileged foothold. Adobe reported the issue directly (APSB26-153); no public exploit code has been identified and there is no confirmed active exploitation (not in CISA KEV) at time of analysis, so the practical risk is concentrated in organizations whose admin panels are internet-exposed with weak credential controls.
Stored cross-site scripting in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows a high-privileged backend user to persist malicious JavaScript into vulnerable admin form fields, which then executes in the browser of any other user who views the affected page, potentially hijacking that victim's account or session. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N, 8.1 High) requires the attacker to already hold a high-privileged backend account (PR:H) and requires a second victim to browse the poisoned page (UI:R); no unauthenticated or low-privilege entry path exists, so this is primarily an insider-abuse or post-compromise escalation vector. There is no public exploit code identified at time of analysis, and despite the High base score our assessment puts real-world priority at medium-to-moderate rather than emergency, with vendor fixes described in Adobe bulletin APSB26-153.
Incorrect authorization checks in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allow a low-privileged authenticated user - such as a registered customer or a limited back-office/B2B account - to bypass security controls and gain unauthorized read and write access, with a limited impact on availability (CVSS 8.3, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L). No administrative role and no victim user interaction are required, so any internet-facing storefront or admin surface exposing the vulnerable authorization check is in scope; the practical gating factor is possession of some valid credential, and stores permitting open customer or B2B self-registration lower that bar considerably. At time of analysis there is no CISA KEV listing and no public exploit identified, and no EPSS score was supplied; the root cause is classified as CWE-863 (Incorrect Authorization) and Adobe has published advisory APSB26-153, which should be treated as the authoritative source for affected and fixed versions.
Remote, low-complexity code execution is possible in Adobe Commerce, Adobe Commerce B2B and Magento Open Source through an incorrect authorization flaw (CWE-863) rated CVSS 9.8, allowing an attacker to act with the privileges of the current request context and escalate to arbitrary code execution without user interaction. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes network-reachable exploitation requiring no prior privileges, which is the strongest signal in the available data. No public exploit code and no CISA KEV entry were identified at time of analysis, and Adobe's only provided reference is advisory APSB26-153; defenders should note Adobe's wording about 'the context of the current user,' which may indicate an existing session or request context is required even though the vector claims PR:N.
Stored cross-site scripting in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows a remote attacker to place persistent JavaScript into a vulnerable form field, which then executes in the browser of any user who browses to the page rendering that field - per the vendor vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N (9.3), the injection step is unauthenticated, but the victim must subsequently visit the affected page, so this cannot fire fully automatically. Because the scope is changed (S:C) and confidentiality and integrity impacts are both High, a successful exploit can cross a trust boundary and yield session or account control over the victim rather than merely degrading the page, though availability is unaffected. There is no confirmed active exploitation (the issue is not in CISA KEV) and no public exploit identified at time of analysis; no EPSS score was supplied with this dataset, so that signal is unavailable.
Stored cross-site scripting (XSS) in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows an authenticated low-privileged attacker to inject malicious JavaScript into vulnerable form fields, which then executes in a victim's browser when they view the affected page. The flaw carries a vendor CVSS 3.1 score of 8.7 (CWE-79) and requires victim interaction; no public exploit or active exploitation is identified at time of analysis. Successful exploitation can lead to theft of session tokens or account manipulation for the victim user.
Server-side template injection in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows remote unauthenticated attackers to execute arbitrary code by injecting special elements into the template engine (CWE-1336). Rated CVSS 10.0 with a changed scope, the flaw requires no user interaction and grants code execution in the context of the current user, per Adobe advisory APSB26-146. No public exploit has been identified at time of analysis, but the maximal score and unauthenticated network reach make this a top-priority patch for e-commerce operators.
Incorrect Authorization (CWE-863) in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plugin enables remote unauthenticated attackers to bypass security controls and gain unauthorized read and limited write access to protected resources. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special network position, making it trivially automatable - a finding corroborated by SSVC's Automatable:yes designation. No public exploit or active exploitation has been identified at time of analysis, and EPSS sits at 0.53% (41st percentile), suggesting limited opportunistic exploitation activity despite the high CVSS score.
Incorrect Authorization in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Webhooks Plugin allows unauthenticated remote attackers to bypass security controls and gain unauthorized read and limited write access to protected resources. The full product ecosystem is affected across multiple active release lines, with vendor-confirmed July 2026 patches available via APSB26-73. No active exploitation has been confirmed (CISA KEV absent, SSVC exploitation: none), though the SSVC framework flags the attack as automatable - meaning mass scanning tools could trivially target exposed storefronts.
Arbitrary code execution in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin stems from improper output encoding/escaping (CWE-116) and lets a high-privileged attacker run code in the context of the current user with no user interaction. Because the scope is changed, exploitation can affect components beyond the initially vulnerable one, and Adobe rates it CVSS 9.1. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.90%, 56th percentile), so risk is currently theoretical/targeted rather than mass-exploited.
Arbitrary code execution in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plugin lets a remote attacker run script in the context of a victim's authenticated session by abusing an unrestricted file-upload flaw (CWE-434). Because the impact executes in the current user's browser/session context and requires the victim to visit a crafted URL or compromised page, the outcome is account/session takeover and privilege escalation rather than direct server compromise. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the EPSS score of 28.32% (98th percentile) signals meaningfully elevated exploitation likelihood for a newly disclosed flaw.
Stored cross-site scripting in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin lets a high-privileged authenticated attacker persist malicious JavaScript in form fields that executes in a victim's browser when the affected page is viewed. Because CVSS scope is changed and the payload runs in the victim's authenticated context, an attacker can escalate to takeover of a higher-privileged admin session or account. No public exploit identified at time of analysis; remediated in Adobe security bulletin APSB26-73.
Stored cross-site scripting in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source lets a low-privileged authenticated attacker persist malicious JavaScript into vulnerable form fields, which then executes in a victim's browser and can escalate to account or session takeover. Because scope is changed (S:C), the injected script runs in a security context beyond the attacker's own privileges - the hallmark of admin-panel or storefront XSS crossing a trust boundary. No public exploit identified at time of analysis, but the 8.7 CVSS and account-takeover impact make this a meaningful priority for e-commerce operators running the affected platforms.
SQL injection in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin allows a high-privileged authenticated attacker to inject malicious SQL that can escalate to arbitrary code execution in the context of the current user, enabling account/session takeover. The flaw (CWE-89) is network-reachable and requires no user interaction, but demands existing high privileges per the CVSS PR:H metric. No public exploit is identified at time of analysis and it is not listed in CISA KEV; EPSS was not provided.
Application denial-of-service in Adobe Commerce (Magento) affects versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier, where an unauthenticated remote attacker can trigger uncontrolled resource consumption (CWE-400) to exhaust system resources without any user interaction. There is no public exploit identified at time of analysis and the EPSS probability is very low (0.01%, 2nd percentile), so while the CVSS availability impact is High (7.5), real-world weaponization appears unlikely in the near term. Impact is limited to availability, with no confidentiality or integrity effect.
Stored cross-site scripting in Adobe Commerce (Magento) lets a low-privileged authenticated user persist malicious JavaScript into vulnerable form fields, which then executes in the browser of any victim who later views the affected page. Because scope is changed, the injected script can escalate to takeover of the victim's account or session, including higher-privileged admin sessions. No public exploit identified at time of analysis, and EPSS is negligible (0.01%, 2nd percentile), indicating low near-term mass-exploitation likelihood.
Server-Side Request Forgery in Adobe Commerce (Magento) versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets a remote attacker bypass security controls and gain unauthorized read access by luring a victim to a maliciously crafted URL or compromised page. Rated CVSS 7.4 with a scope-changed impact, the flaw affects the e-commerce platform's server-side request handling. There is no public exploit identified at time of analysis, and EPSS is low (0.13%, 32nd percentile), so exploitation is currently theoretical rather than observed.
Arbitrary file system read and write in Adobe Commerce (Magento) versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets an authenticated administrator escape the intended restricted directory via path traversal, reading or writing files anywhere the web application user has access. Because scope is changed (S:C), the impact can extend beyond the vulnerable component. No public exploit identified at time of analysis, and EPSS is low (0.09%, 26th percentile), consistent with the high-privilege prerequisite.
Denial-of-service in Adobe Commerce (Magento) versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets a remote unauthenticated attacker crash the application by exercising a bundled vulnerable third-party component, taking the storefront offline. The flaw carries CVSS 7.5 with an availability-only impact and no confidentiality or integrity effect; there is no public exploit identified at time of analysis, and EPSS is low at 0.07%. It was reported by Adobe and addressed in security bulletin APSB26-49.
Improper authorization in Adobe Commerce (Magento) 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets a remote unauthenticated attacker (CVSS PR:N) bypass a security control and gain unauthorized write access to the affected system, with no user interaction. There is no public exploit identified at time of analysis and the EPSS score is low (0.09%), but the network-reachable, no-auth, no-interaction vector combined with Adobe's own reporting warrants prompt patching. This is not in CISA KEV and shows no confirmed exploitation.
Application denial-of-service in Adobe Commerce (Magento) affects versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier, where an Uncontrolled Resource Consumption flaw (CWE-400) lets a remote, unauthenticated attacker exhaust server resources without any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/A:H) reflects a high availability impact with no confidentiality or integrity loss. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.01%, 2nd percentile), indicating minimal observed exploitation interest despite the network-reachable attack surface.
Uncontrolled resource consumption in Adobe Commerce (Magento) versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets a remote attacker exhaust system resources and force an application-level denial-of-service without any authentication or user interaction. The flaw carries a CVSS 7.5 (availability-only) rating and, per Adobe's APSB26-49 advisory, affects the e-commerce platform's server-side request handling. There is no public exploit identified at time of analysis and the EPSS score is very low (0.04%, 12th percentile), indicating no observed exploitation activity to date.
Denial-of-service in Adobe Commerce (Magento) 2.4.4-p17, 2.4.5-p16, 2.4.6-p14, 2.4.7-p9, 2.4.8-p4, 2.4.9-beta1 and earlier allows a remote attacker to exhaust system resources and render the application unavailable without any authentication or user interaction. The flaw is an Uncontrolled Resource Consumption (CWE-400) issue reported by Adobe (APSB26-49); it carries a CVSS 7.5 (availability-only impact) with no confidentiality or integrity effect. There is no public exploit identified at time of analysis and the EPSS score is very low (0.04%), indicating no observed weaponization to date.
Improper authorization in Adobe Commerce (Magento) lets remote unauthenticated attackers bypass security controls and gain unauthorized write access across builds 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier. The flaw (CWE-863) requires no user interaction and is exploitable over the network per its CVSS:3.1 vector, though there is no public exploit identified at time of analysis and it is not on CISA KEV. EPSS is low (0.09%, 26th percentile), but CISA SSVC marks it 'Automatable: yes', meaning any working exploit could be scaled easily.
Adobe Commerce, along with Magento Open Source and Adobe Commerce B2B, contains an improper input validation vulnerability that allows an authenticated low-privilege attacker to bypass security features and gain unauthorized read access. The flaw is network-reachable, requires no user interaction, and is limited to confidentiality impact (read-only) with a CVSS score of 4.3, making it a moderate-severity, lower-priority issue. No public exploit code or confirmed active exploitation has been identified in the available intelligence.
Incorrect Authorization (CWE-863) in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plugin exposes sensitive data to unauthenticated remote attackers who can bypass security controls to gain unauthorized read access. Exploitation is constrained by high attack complexity - conditions beyond the attacker's control must be satisfied - which aligns with the SSVC assessment of non-automatable exploitation and the low EPSS score of 0.61% (45th percentile). No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog as of analysis date; Adobe has released July 2026 patches across all affected product lines per advisory APSB26-73.
Stored Cross-Site Scripting in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin allows a high-privileged attacker to inject persistent malicious JavaScript into vulnerable admin form fields, which then executes in any victim's browser that navigates to the affected page. Scope change (S:C) is confirmed in the CVSS vector, meaning the injected payload crosses from the Commerce application security boundary into the victim's browser session, enabling session hijacking or credential harvesting. Despite no current KEV listing, the EPSS score sits at the 96th percentile (11.52%), warranting close monitoring even though CISA SSVC currently rates exploitation as none and the attack is not assessed as automatable.
Incorrect authorization in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin exposes sensitive data to remote unauthenticated attackers who can bypass security controls to gain unauthorized read access. Classified as CWE-863 (Incorrect Authorization), the flaw carries a CVSS 3.1 score of 5.9 with high confidentiality impact but is gated by high attack complexity - exploitation depends on conditions outside the attacker's control. No public exploit has been identified at time of analysis, EPSS stands at 0.61% (45th percentile), and CISA SSVC assesses exploitation as none and not automatable, indicating meaningful barriers to opportunistic mass exploitation.
Open redirect in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin allows remote unauthenticated attackers to construct malicious URLs that silently forward victims to attacker-controlled phishing sites, enabling credential theft and account takeover. The flaw spans the full product family across multiple supported version branches and was disclosed by Adobe via Security Bulletin APSB26-73 with patches released in July 2026. No public exploit code has been identified at time of analysis, and SSVC rates exploitation status as 'none' with EPSS at 0.74% (50th percentile), indicating limited real-world exploitation signal despite broad product prevalence.
Limited sensitive information disclosure in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plugin enables unauthenticated remote attackers to obtain restricted data under high-complexity conditions. The CWE-200 flaw requires no user interaction but exploitation depends on factors outside attacker control - such as race conditions or specific environmental state - sharply constraining practical exploitation. No active exploitation is confirmed: SSVC rates exploitation as none, EPSS stands at 0.57% (43rd percentile), and the vulnerability is absent from the CISA KEV catalog; Adobe has released July 2026 security patches across all affected product lines via APSB26-73.
Stored XSS in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Commerce Webhooks Plugin enables a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, executing in victims' browsers upon page load. Affected versions span Adobe Commerce through 2.4.9/p-series, Magento Open Source through 2.4.9, B2B through 1.5.3, and Webhooks Plugin through 1.20.0. The CVSS scope change (S:C) indicates the injected script can operate beyond the originating application's security context, raising the practical impact when higher-privileged users such as store administrators visit the compromised page. No public exploit has been identified at time of analysis and CISA has not listed this in KEV.
Security feature bypass in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks plugin allows a high-privileged, authenticated attacker to defeat an authorization check (CWE-863) and gain unauthorized read access to data that should be restricted. The flaw is network-reachable with low complexity, requires no user interaction, and changes scope, so the exposure can reach beyond the initially vulnerable component. There is no public exploit identified at time of analysis and no CISA KEV listing, making exploitation currently theoretical rather than observed.
Improper authorization in Adobe Commerce allows unauthenticated remote attackers to bypass security controls and achieve unauthorized write access to the affected storefront or backend by luring a victim into visiting a crafted URL or a compromised web page. All supported release lines through versions 2.4.8-p4 and 2.4.9-beta1 are confirmed affected per Adobe Security Bulletin APSB26-49. No public exploit code or active exploitation has been identified at time of analysis; EPSS is 0.03% (8th percentile) and SSVC exploitation status is 'none', placing this in the lower tier of operational urgency despite a network-accessible attack vector.
Stored Cross-Site Scripting in Adobe Commerce allows a high-privileged attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in any victim's browser upon visiting the affected page. All active release trains from 2.4.4 through 2.4.8 are affected, along with the 2.4.9-beta1 pre-release. No public exploit identified at time of analysis; an EPSS score of 0.02% (5th percentile) and SSVC exploitation status of 'none' confirm negligible current exploitation activity, keeping real-world urgency low despite the stored nature of the flaw.
Improper Input Validation in Adobe Commerce allows a high-privileged attacker to bypass security controls and gain unauthorized write access to the filesystem, with scope change crossing a security boundary. The vulnerability affects versions up to 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17, and 2.4.9-beta1. No public exploit has been identified at time of analysis, and EPSS sits at 0.04% (11th percentile), reflecting negligible real-world exploitation activity despite the scope-changed integrity impact.
Stored Cross-Site Scripting in Adobe Commerce 2.4.x allows a high-privileged attacker to inject persistent JavaScript payloads into vulnerable form fields, which execute in the browser of any user who subsequently views the affected page. The scope change (S:C) means injected scripts run in the victim's browser security context, enabling session hijacking or unauthorized action execution against lower-privileged users. No public exploit code has been identified and EPSS at 0.06% (20th percentile) with SSVC exploitation status of 'none' confirm no current active exploitation.
Remote denial-of-service in Adobe Commerce, exploitable without authentication, stems from a dependency on a vulnerable third-party component (CWE-1395) that can be triggered to crash the application. Affected releases span a wide version range including 2.4.9-beta1 through 2.4.4-p17 and earlier. No public exploit or CISA KEV listing exists at time of analysis, and the EPSS score of 0.07% places this in the 22nd percentile - reflecting limited observed exploitation interest despite the attack being automatable per the SSVC framework.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a blind SSRF vulnerability in the bundled dotmailer extension. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the API File Option Upload Extension. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability via the `quoteId` parameter. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the Multishipping Module. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a Path Traversal vulnerability via the `theme[preview_image]` parameter. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability when saving a configurable product. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability that could be abused by an attacker to inject. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability in the customer address upload feature that. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability while saving a customer's details with a. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper Neutralization of Special Elements Used In A Command via the Data collection. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.