CVE-2025-27206

MEDIUM

Adobe Commerce <2.4.8 - Privilege Escalation

Title source: llm

Description

Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited write access. Exploitation of this issue does not require user interaction.

References (1)

[Vendor Advisory] https://helpx.adobe.com/security/products/magento/apsb25-50.html

Scores

CVSS v3 5.3

EPSS 0.0015

EPSS Percentile 35.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Classification

CWE

CWE-284

Status published

Affected Products (50)

adobe/commerce

... and 35 more

Timeline

Published Jun 10, 2025

Tracked Since Feb 18, 2026