Adobe Commerce versions 2.4.9‑alpha3, 2.4.8‑p3, 2.4.7‑p8, 2.4.6‑p13, 2.4.5‑p15, 2.4.4‑p16 and earlier contain an improper input validation flaw (CWE‑20) that can cause a brief interruption of application availability. The vulnerability is triggered by specially crafted input and does not require user interaction, meaning an attacker can target the exposed interface from the network. The affected products are the commercial Adobe Commerce bundle and the open‑source Magento code base, as indicated by the listed CPE entries. No exploitation evidence is listed in the CISA KEV catalog and the EPSS score is below 1 %, suggesting a low likelihood of current exploitation. However, the CVSS score of 5.3 classifies the issue as moderate severity.

This vulnerability impacts Adobe Commerce (commercial) and Magento (open‑source) in all releases up to and including version 2.4.9‑alpha3, specifically 2.4.9‑alpha3, 2.4.8‑p3, 2.4.7‑p8, 2.4.6‑p13, 2.4.5‑p15, 2.4.4‑p16 and all earlier versions.

The attack vector is likely network‑based, where an unauthenticated attacker can send malformed requests to any publicly exposed Magento or Adobe Commerce endpoint. The vulnerability’s exploitation does not require user interaction or privileged access. Given the moderate CVSS score and low EPSS, the immediate risk is considered moderate, but protection should still be applied.