What’s Vulnerable › Products

Adobe Commerce vulnerabilities

214 known vulnerabilities, 5 confirmed exploited in the wild (CISA KEV), 110 published in the last 12 months.

Check whether your Adobe Commerce version is affected

Exploited Adobe Commerce vulnerabilities

• CVE-2026-71362 — Adobe Commerce and Magento Incorrect Authorization Vulnerability
• CVE-2026-75650 — Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
• CVE-2025-54236 — Adobe Commerce and Magento Improper Input Validation Vulnerability
• CVE-2024-34102 — Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability
• CVE-2022-24086 — Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability

Latest Adobe Commerce vulnerabilities

• CVE-2026-77774 — Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 8.6)
• CVE-2026-77111 — Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 8.7)
• CVE-2026-77110 — Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (CVSS 7.6)
• CVE-2026-77109 — Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 8.6)
• CVE-2026-77108 — Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 7.5)
• CVE-2026-76202 — Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 8.2)
• CVE-2026-76201 — Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 9.3)
• CVE-2026-76200 — Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 9.3)
• CVE-2026-75650 — Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability (CVSS 10.0) — exploited
• CVE-2026-71362 — Adobe Commerce and Magento Incorrect Authorization Vulnerability (CVSS 9.1) — exploited
• CVE-2026-48416 — Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 7.5)
• CVE-2026-48415 — Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 8.3)
• CVE-2026-48414 — Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 8.7)
• CVE-2026-48413 — Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 8.7)
• CVE-2026-48412 — Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 7.2)
• CVE-2026-48411 — Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 4.9)
• CVE-2026-48371 — Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4)
• CVE-2026-48358 — Adobe Commerce | Improper Encoding or Escaping of Output (CWE-116) (CVSS 9.1)
• CVE-2026-48356 — Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434) (CVSS 9.3)
• CVE-2026-48001 — Adobe Commerce | Information Exposure (CWE-200) (CVSS 3.7)
• CVE-2026-48000 — Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) (CVSS 6.1)
• CVE-2026-47999 — Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 4.8)
• CVE-2026-47998 — Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 5.9)
• CVE-2026-47997 — Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 5.9)
• CVE-2026-47996 — Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 6.8)