Adobe Commerce is affected by a dependency on a vulnerable third‑party component that can crash the application. Because the crash terminates service, an attacker can trigger an application denial‑of‑service. The weakness is a CWE‑1395 failure to protect against a compromised third‑party module. No data indicates data loss or unauthorized access; the primary impact is loss of availability.

Adobe Commerce versions 2.4.9‑beta1, 2.4.8‑p4, 2.4.7‑p9, 2.4.6‑p14, 2.4.5‑p16, 2.4.4‑p17 and all earlier releases are vulnerable.

The CVSS score of 7.5 signals high severity. The EPSS score is <1% (0.00095), indicating a low exploitation probability, and the vulnerability is not in the CISA KEV catalog. Exploitation does not require user interaction, implying that an attacker can trigger the crash without any human action, possibly via a crafted request to the application or by supplying a malicious dependency in the deployment package. The lack of user interaction also suggests that the attack could be automated and may impact multiple instances if the vulnerable component is widely used.