CVE-2025-43586

What it is

Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result in privilege escalation. A low privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized elevated access. Exploitation of this issue does not require user interaction.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account. High risk of data exposure, data tampering.

Exploit odds

0.6% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2025-06-10 16:15 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-06-17 09:24 UTC Last updatedMost recent change to the record

Details

Published

2025-06-10 16:15 UTC

Last modified

2026-06-17 09:24 UTC

Exploit probability

0.6% · EPSS, next 30 days

Weakness

CWE-284 · Improper access control

Record status

Analyzed

Affected

• Adobe Commerce 2.4.4
• Adobe Commerce 2.4.5
• Adobe Commerce 2.4.6
• Adobe Commerce 2.4.7
• Adobe Commerce 2.4.8
• Adobe Commerce b2b 1.3.3
• Adobe Commerce b2b 1.3.4
• Adobe Commerce b2b 1.3.5

Attack profile CVSS 3.1 · 8.1

Attack vector

Network

Complexity

Low

Privileges needed

Low

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None