The vulnerability is an uncontrolled resource consumption flaw that allows attackers to exhaust system resources and trigger a denial‑of‑service condition on Adobe Commerce applications. This weakness, classified as CWE‑400, can cause the affected application to become unresponsive or crash without requiring any user interaction. The impact is limited to application availability but can indirectly affect end‑users through service disruption.

Adobe Commerce version 2.4.9-beta1, 2.4.8‑p4, 2.4.7‑p9, 2.4.6‑p14, 2.4.5‑p16, 2.4.4‑p17 and all earlier releases are susceptible. Any deployment of these versions is at risk until updated.

The CVSS base score of 7.5 indicates a high severity of the problem, while the lack of an EPSS score and absence from the KEV list suggest that there is no current evidence of widespread exploitation. Nonetheless, the flaw can be triggered remotely without authentication or user interaction, making it a low‑barrier attack. Adversaries could target the resource‑intensive features of the CMS or employ automated requests to exhaust memory or CPU, leading to a denial‑of‑service.