CVE-2026-34646

What it is

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

At a glance

Exploitability

Can be exploited over the network without logging in. High risk of data tampering.

Exploit odds

0.4% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-05-12 20:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-26 18:10 UTC Last updatedMost recent change to the record

Details

Published

2026-05-12 20:16 UTC

Last modified

2026-10-26 18:10 UTC

Exploit probability

0.4% · EPSS, next 30 days

Weakness

CWE-863 · Incorrect authorization

Record status

Analyzed

Affected

• Adobe Commerce < 2.4.4
• Adobe Commerce 2.4.4
• Adobe Commerce 2.4.5
• Adobe Commerce 2.4.6
• Adobe Commerce 2.4.7
• Adobe Commerce 2.4.8
• Adobe Commerce 2.4.9
• Adobe Commerce b2b < 1.3.3

Attack profile CVSS 3.1 · 7.5

Attack vector

Network

Complexity

Low

Privileges needed

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None