CVE-2025-54263

highpriority · track · 0OT risk · elevatedEPSS 0.006 · 48 %ileDEEUNLUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.60% (48th) EPSS

CVSS 8.1 · high

Is it mine?

36 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · cert_bund · ncsc_nl

EPSS · scored 2026-10-27

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. A low-privileged attacker could leverage this vulnerability to bypass security measures and maintain unauthorized access. Exploitation of this issue does not require user interaction.

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · psirt@adobe.comexploitability 2.8 · impact 5.2

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · OSV

v3.17.4highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-284USCWE-863USCWE-863US

affected products (36)

Products and version ranges known to be affected.

Adobe Magento <2.4.5-p15all versionscert_bundDE
Adobe Magento <2.4.6-p13all versionscert_bundDE
Adobe Magento <2.4.7-p8all versionscert_bundDE
Adobe Magento <2.4.8-p3all versionscert_bundDE
Adobe Magento <2.4.9-alpha3all versionscert_bundDE
Adobe Magento< 2.4.5-p15cert_bundDE
Adobe Magento< 2.4.6-p13cert_bundDE
Adobe Magento< 2.4.7-p8cert_bundDE
Adobe Magento< 2.4.8-p3cert_bundDE
Adobe Magento< 2.4.9-alpha3cert_bundDE
Adobe Adobe Commerce≤ 0 ≤2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15enisa_euvdEU
Adobe Commerce≤ vers:unknown/*ncsc_nlNL
Adobe Magento≤ vers:unknown/*ncsc_nlNL
Adobe Magento Open Source≤ vers:unknown/*ncsc_nlNL
adobe commerce= 2.4.4nvdUScpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*
adobe commerce= 2.4.5nvdUScpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*
adobe commerce= 2.4.6nvdUScpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*
adobe commerce= 2.4.7nvdUScpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*
adobe commerce= 2.4.8nvdUScpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*
adobe commerce= 2.4.9nvdUScpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*

showing 20 of 36

advisories (3)

Vendor and ecosystem advisories describing this.

NCSC-2025-0322Kwetsbaarheden verholpen in Adobe CommerceNL2025-10-16csaf · ncsc_nlNL
Adobe heeft kwetsbaarheden verholpen in Adobe Commerce (Specifiek voor versies 2.4.9-alpha2 en eerder).
WID-SEC-W-2025-2295Adobe Magento: Mehrere SchwachstellenDeutsch2025-10-14csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Adobe Magento ausnutzen, um Sicherheitsvorkehrungen zu umgehen, privilegien zu eskalieren und code auszuführen.
GHSA-69x9-xp2j-w8g8Magento provides incorrect authorization through a security feature bypass2025-10-14ghsa · osvUS
Magento versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. A low-privileged attacker could leverage this vulnerability to bypass security measures and maintain unauthorized access. Exploitation of this issue does not require user interaction.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund ncsc_nl nvd osv NVD CVE.org MITRE

published 2025-10-14modified 2026-06-17

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan