CVE-2026-34646: Adobe Commerce

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

Affected products

• Adobe Commerce: before 2.4.4 (fixed in 2.4.4); version 2.4.4 only; version 2.4.5 only; version 2.4.6 only; version 2.4.7 only; version 2.4.8 only; …
• Adobe Commerce b2b: before 1.3.3 (fixed in 1.3.3); version 1.3.3 only; version 1.3.4 only; version 1.4.2 only; version 1.5.2 only; version 1.5.3 only
• Adobe Magento: before 2.4.6 (fixed in 2.4.6); version 2.4.6 only; version 2.4.7 only; version 2.4.8 only; version 2.4.9 only

Published 2026-05-12. Last modified 2026-08-28.