Adobe Commerce suffers from an incorrect authorization weakness that allows an attacker with high privileges to bypass security features and obtain unauthorized write access. This breach can disrupt availability by enabling an attacker to modify application data or configuration. The vulnerability is a direct consequence of improper enforcement of access controls, as indicated by its classification as CWE-863.

Affected products include Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. Version information is not specified in the available data, so all current releases are potentially impacted until a vendor‑supplied fix is applied.

The CVSS score of 8.7 classifies this issue as high severity. EPSS score 0.00509 indicates a very low but nonzero exploitation probability; the vulnerability does not require user interaction, meaning that an attacker controlling a privileged account can exploit it remotely or locally without further assistance. The attack vector is likely a privileged‑level attack that can manipulate administrative interfaces or APIs. The vulnerability is not listed in the CISA KEV catalog, and no specific exploit code is publicly known, though the scope change indicates that privilege escalation is achievable. Given these factors, the risk remains significant, especially in environments where high‑privileged accounts have broad access.