Description
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction.
Published: 2026-07-14
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an Incorrect Authorization flaw (CWE-863) that enables an attacker to bypass security measures in Adobe Commerce, its B2B component, the Webhooks Plugin, or Magento Open Source. By exploiting this flaw, an attacker can read data and perform limited write operations without user interaction, potentially causing a modest disruption in availability while exposing or modifying sensitive information.

Affected Systems

Adobe Commerce, Adobe Commerce B2B, Adobe Commerce Webhooks Plugin, Magento Open Source. No specific affected version numbers are disclosed in the CVE data, so all current releases may be vulnerable until a patch becomes available.

Risk and Exploitability

The CVSS score of 8.6 indicates high severity, while the EPSS score of less than 1% shows a low estimated probability of exploitation as of this analysis. The vulnerability is not listed in the CISA KEV catalog. Because the description states that exploitation does not require user interaction, the likely attack vector is remote, possibly through crafted requests to the affected components, although the exact method is not detailed in the CVE.

Generated by OpenCVE AI on August 5, 2026 at 02:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Adobe Commerce, Adobe Commerce B2B, the Webhooks Plugin, and Magento Open Source to the latest patched versions released by Adobe.
  • If a patch is not yet available, disable or restrict access to the endpoints affected by the authorization flaw—particularly those that expose the Webhooks Plugin or B2B functionality—until remediation can be applied.
  • Enable extensive logging and monitoring for unauthorized read/write attempts, and audit ACLs regularly to detect potential abuse of the flaw.

Generated by OpenCVE AI on August 5, 2026 at 02:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 22:45:00 +0000

Type Values Removed Values Added
Description Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction. Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction.

Mon, 03 Aug 2026 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe adobe Commerce
Adobe adobe Commerce B2b
Adobe adobe Commerce Webhooks Plugin
Adobe magento Open Source
Vendors & Products Adobe
Adobe adobe Commerce
Adobe adobe Commerce B2b
Adobe adobe Commerce Webhooks Plugin
Adobe magento Open Source

Wed, 15 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Description Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction.
Title Adobe Commerce | Incorrect Authorization (CWE-863)
Weaknesses CWE-863
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L'}

Subscriptions

Adobe Adobe Commerce Adobe Commerce B2b Adobe Commerce Webhooks Plugin Commerce Commerce B2b I\/o Events Magento Magento Open Source
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-08-04T22:22:21.090Z

Reserved: 2026-05-20T15:50:31.367Z

Link: CVE-2026-47988

cve-icon Vulnrichment

Updated: 2026-07-15T14:09:17.588Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-14T20:17:04.347

Modified: 2026-08-05T17:33:02.013

Link: CVE-2026-47988

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T02:45:17Z

Weaknesses