Adobe Commerce version 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and all earlier releases contain a Server‑Side Request Forgery (SSRF) flaw that allows a high‑privileged attacker to manipulate outbound server‑side requests and bypass security controls. This vulnerability does not require user interaction and is categorized under CWE‑918.

The affected product family is Adobe Commerce (also listed as Adobe Magento open source via CPE strings). Affected releases include all 2.4.4 through 2.4.9-alpha3 releases, specifically the patched point releases 2.4.4‑p16, 2.4.5‑p15, 2.4.6‑p13, 2.4.7‑p8, 2.4.8‑p3 and 2.4.9‑alpha3, as well as any earlier unpatched versions.

The CVSS score is 5.5, indicating moderate severity, and the EPSS probability is less than 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in KEV, and only high‑privileged users can trigger it. The attack vector is likely an internal network or exposed API endpoint that can be accessed without user interaction, enabling the attacker to request arbitrary URLs from the server and potentially reach otherwise protected resources.