Adobe Vulnerabilities and Affected Products
Vulnerabilities associated with Adobe Commerce.
Products
Clear product- Adobe Experience Manager1,018 vulnerabilities
- Adobe Acrobat and Reader516 vulnerabilities
- Acrobat Reader447 vulnerabilities
- Adobe Commerce190 vulnerabilities
- ColdFusion149 vulnerabilities
- Illustrator149 vulnerabilities
- InDesign Desktop131 vulnerabilities
- After Effects119 vulnerabilities
- Dimension116 vulnerabilities
- Bridge114 vulnerabilities
- Animate101 vulnerabilities
- Experience Manager98 vulnerabilities
- InDesign96 vulnerabilities
- Substance3D - Stager87 vulnerabilities
- Magento Commerce85 vulnerabilities
- Adobe Framemaker82 vulnerabilities
- experience_manager78 vulnerabilities
- Substance3D - Painter78 vulnerabilities
- Flash Player70 vulnerabilities
- InCopy65 vulnerabilities
- Photoshop58 vulnerabilities
- experience_manager_cloud_service53 vulnerabilities
- acrobat_reader49 vulnerabilities
- FrameMaker48 vulnerabilities
- acrobat_reader_dc47 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-48414HIGH | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Exploit depends on conditions beyond the attacker's control. Scope is changed. CWE-79Aug 11, 2026 | CVSS7.7v3.1 | EPSS0.533% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-48416HIGH | Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. CWE-863Aug 11, 2026 | CVSS7.5v3.1 | EPSS0.495% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-48413HIGH | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed. CWE-79Aug 11, 2026 | CVSS8.7v3.1 | EPSS0.628% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-48415HIGH | Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction. CWE-863Aug 11, 2026 | CVSS7.6v3.1 | EPSS0.349% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to restricted resources. Exploitation of this issue does not require user interaction. CWE-863Aug 11, 2026 | CVSS2.7v3.1 | EPSS0.315% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2026-48411MEDIUM | Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. CWE-863Aug 11, 2026 | CVSS6.5v3.1 | EPSS0.494% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-71362CRITICAL | Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction. CWE-863Aug 11, 2026 | CVSS9.1v3.1 | EPSS0.478% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-47984HIGH | Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction. CWE-863Jul 14, 2026 | CVSS8.2v3.1 | EPSS0.641% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-47997MEDIUM | Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. CWE-863Jul 14, 2026 | CVSS5.9v3.1 | EPSS8.99% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-47988HIGH | Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction. CWE-863Jul 14, 2026 | CVSS8.6v3.1 | EPSS0.667% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-47999MEDIUM | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed. CWE-79Jul 14, 2026 | CVSS4.8v3.1 | EPSS7.08% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-48358CRITICAL | Adobe Commerce | Improper Encoding or Escaping of Output (CWE-116)Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. CWE-116Jul 14, 2026 | CVSS9.1v3.1 | EPSS1.49% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-48356CRITICAL | Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed. CWE-434Jul 14, 2026 | CVSS9.3v3.1 | EPSS28.2% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-47998MEDIUM | Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. CWE-863Jul 14, 2026 | CVSS5.9v3.1 | EPSS0.633% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-48000MEDIUM | Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)Adobe Commerce is affected by an Improper Redirect (Open Redirect) vulnerability that could result in a Security feature bypass. An attacker could construct a malicious URL that redirects a victim to an attacker-controlled site. Exploitation of this issue requires user interaction in that a victim must click on a malicious link. Scope is changed. CWE-601Jul 14, 2026 | CVSS6.1v3.1 | EPSS0.353% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-47995HIGH | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed. CWE-79Jul 14, 2026 | CVSS8.1v3.1 | EPSS0.397% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Adobe Commerce | Information Exposure (CWE-200)Adobe Commerce is affected by an Information Exposure vulnerability that could lead to a limited disclosure of sensitive information. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. CWE-200Jul 14, 2026 | CVSS3.7v3.1 | EPSS0.564% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2026-48371MEDIUM | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed. CWE-79Jul 14, 2026 | CVSS5.4v3.1 | EPSS0.182% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-47996MEDIUM | Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce is affected by an Incorrect Authorization vulnerability that could lead to arbitrary file system read. A high-privileged attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed. CWE-863Jul 14, 2026 | CVSS6.8v3.1 | EPSS19.9% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-47994HIGH | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed. CWE-79Jul 14, 2026 | CVSS8.7v3.1 | EPSS0.622% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-47992HIGH | Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)Adobe Commerce is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could exploit this vulnerability to execute malicious SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. CWE-89Jul 14, 2026 | CVSS7.2v3.1 | EPSS19.9% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-34656MEDIUM | Adobe Commerce | Improper Authorization (CWE-285)Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. CWE-285May 12, 2026 | CVSS4.3v3.1 | EPSS0.393% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-34658MEDIUM | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed. CWE-79May 12, 2026 | CVSS4.8v3.1 | EPSS0.274% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-34650HIGH | Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction. CWE-400May 12, 2026 | CVSS7.5v3.1 | EPSS15.9% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-34686HIGH | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed. CWE-79May 12, 2026 | CVSS8.7v3.1 | EPSS0.402% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |