CVE-2026-47998
Adobe Commerce | Incorrect Authorization (CWE-863)
At a glance Severity MEDIUM 5.9 EPSS EPSS 0.71 % · percentile 53 (2026-10-27) State PUBLISHED Published 2026-07-14 Updated 2026-08-27 Assigner adobe NVD status Analyzed Description Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.
Scores Version Score Vector Scored by CVSS 3.1 MEDIUM 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N adobe CVSS 3.1 MEDIUM 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N NVD · psirt@adobe.com (Secondary)
Weaknesses (CWE)
European references
Affected configurations (NVD CPE) cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p10:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p11:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p12:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p13:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p14:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p15:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p16:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p17:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p18:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p7:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p8:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p9:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p10:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p11:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p12:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p13:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p14:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p15:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p16:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p17:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p3:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p4:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p5:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p6:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p7:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p8:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p9:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.6:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.6:p1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.6:p10:*:*:*:*:*:*+131 more Affected products Product Versions Adobe · Adobe Commerce affected 0 ≤ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 ; unaffected 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul Adobe · Adobe Commerce B2B affected 0 ≤ 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 ; unaffected 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul Adobe · Magento Open Source affected 0 ≤ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 ; unaffected 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul Adobe · Adobe Commerce Events affected 0 ≤ 1.20.0 ; unaffected 1.21.0
References
Sources
