Adobe Commerce | Incorrect Authorization (CWE-863) (Adobe Adobe Commerce)
At a glance
- Source
- NVD
- EPSS
- EPSS 90.49 % · percentile 100 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- adobe
- NVD status
- Analyzed
Description
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.
Weaknesses (CWE)
- CWE-863 — Incorrect Authorization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | adobe |
| CVSS 3.1 | CRITICAL 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | NVD · psirt@adobe.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-56844
- GCVE · GCVE-0-2026-71362
CERT-FR advisories
- CERTFR-2026-AVI-1017 — Multiples vulnérabilités dans les produits Adobe · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*< 2.4.4cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p10:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p11:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p12:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p13:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p14:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p15:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p16:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p17:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p18:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p7:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p8:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p9:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p10:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p11:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p12:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p13:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p14:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p15:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p16:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p17:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p3:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p4:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p5:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p6:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p7:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p8:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p9:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.6:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.6:p1:*:*:*:*:*:*- +117 more
Affected products
| Product | Versions |
|---|---|
| Adobe · Adobe Commerce | affected 0 ≤ 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug ; unaffected 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug |
| Adobe · Adobe Commerce B2B | affected 0 ≤ 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul ; unaffected 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug |
| Adobe · Magento Open Source | affected 0 ≤ 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul ; unaffected 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |