Adobe Commerce is vulnerable to an improper input validation flaw that can allow an attacker with high privileges to execute arbitrary code in the context of the current user. The flaw is a classic injection of malformed data that bypasses the system’s validation checks before being processed, resulting in code execution. The vulnerability’s scope is changed, meaning that an exploit can impact multiple components of the application once triggered.

Adobe’s e-commerce platform, including Adobe Commerce, Adobe Commerce B2B, and Magento Open Source, are affected. No specific version numbers are listed, so any unpatched instance of these products may be vulnerable until an update is applied.

The CVSS score of 9.1 indicates a high severity risk. The EPSS score is not available, so the precise exploitation probability cannot be quantified, but the CVE appears in no KEV catalog, suggesting no confirmed active exploitation yet. The vulnerability does not require user interaction, and the attack vector is inferred to be remote via crafted HTTP requests to the web interface, given the nature of the input validation flaw and the fact that scope is changed.