CVE-2026-34648

highpriority · track · 7EPSS 0.214 · 98 %ileDEEUNLRUUS

grimoire priorityP1 · Urgent

Exploitable?

—

no known exploitation

Likely / severe?

21.4% (98th) EPSS

CVSS 7.5 · high

Is it mine?

45 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · psirt@adobe.comexploitability 3.9 · impact 3.6

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-400USCWE-400US

affected products (45)

Products and version ranges known to be affected.

Adobe Magento <2.4.6-p15all versionscert_bundDE
Adobe Magento <2.4.7-p10all versionscert_bundDE
Adobe Magento <2.4.8-p5all versionscert_bundDE
Adobe Magento <2.4.9all versionscert_bundDE
Adobe Magento< 2.4.6-p15cert_bundDE
Adobe Magento< 2.4.7-p10cert_bundDE
Adobe Magento< 2.4.8-p5cert_bundDE
Adobe Magento< 2.4.9cert_bundDE
Adobe Adobe Commerce≤ 0 ≤2.4.4-p17enisa_euvdEU
Adobe Systems Inc. Adobe Commerce≤ 2.4.9-beta1fstec_bduRU
Adobe Systems Inc. Adobe Commerce≤ 2.4.4-p17fstec_bduRU
Adobe Systems Inc. Adobe Commerce≤ 2.4.5-p16fstec_bduRU
Adobe Systems Inc. Adobe Commerce≤ 2.4.6-p14fstec_bduRU
Adobe Systems Inc. Adobe Commerce≤ 2.4.7-p9fstec_bduRU
Adobe Systems Inc. Adobe Commerce≤ 2.4.8-p4fstec_bduRU
Adobe Systems Inc. Adobe Commerce B2B≤ 1.4.2-p9fstec_bduRU
Adobe Systems Inc. Adobe Commerce B2B≤ 1.5.2-p4fstec_bduRU
Adobe Systems Inc. Adobe Commerce B2B≤ 1.5.3-beta1fstec_bduRU
Adobe Systems Inc. Adobe Commerce B2B≤ 1.3.3-p17fstec_bduRU
Adobe Systems Inc. Adobe Commerce B2B≤ 1.3.4-p16fstec_bduRU

showing 20 of 45

advisories (2)

Vendor and ecosystem advisories describing this.

NCSC-2026-0152Kwetsbaarheden verholpen in Adobe CommerceNL2026-05-13csaf · ncsc_nlNL
Adobe heeft meerdere kwetsbaarheden verholpen in Adobe Commerce.
WID-SEC-W-2026-1497Adobe Magento: Mehrere SchwachstellenDeutsch2026-05-12csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Adobe Magento ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren oder einen Denial-of-Service-Zustand zu verursachen.

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund ncsc_nl NVD CVE.org MITRE

published 2026-05-12modified 2026-10-26

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan