What’s Vulnerable › Vulnerabilities

CVE-2026-48415: Adobe Commerce | Incorrect Authorization (CWE-863)

• Severity: high (CVSS 8.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-11 · updated 2026-09-25
• Weakness: CWE-863

Description

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction.

Affected products

• Adobe Commerce: 2.4.4-p1, 2.4.4-p10, 2.4.4-p11, 2.4.4-p12, 2.4.4-p13, 2.4.4-p14 (+60)
• Adobe Commerce: 1.3.3-p1, 1.3.3-p10, 1.3.3-p2, 1.3.3-p3, 1.3.3-p4, 1.3.3-p5 (+22)
• Adobe Magento: 2.4.6-p1, 2.4.6-p10, 2.4.6-p11, 2.4.6-p12, 2.4.6-p13, 2.4.6-p14 (+25)
• Adobe Commerce: through 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug
• Adobe Commerce: through 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul
• Adobe Magento Open Source: through 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul

References

• https://helpx.adobe.com/security/products/magento/apsb26-92.html

Get alerted when CVE-2026-48415 or the next vulnerability affects your stack