CVE-2026-34685
LowCVSS 3.4Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Adobe Commerce is affected by an Improper Input Validation vulnerability that could lead to a security feature bypass. A high-privileged attacker can gain unauthorized write access, requiring user interaction such as visiting a malicious URL.
Risk Assessment
The risk involves bypassing security measures to gain unauthorized write access, potentially allowing data or configuration modifications in the store.
Recommendation
Immediately update Adobe Commerce to version 2.4.9-beta1 or later, and apply security patches for earlier affected versions.
Original NVD description (English source)
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.