Adobe Commerce | Improper Input Validation (CWE-20)
Summary
| CVE | CVE-2026-92464 |
|---|---|
| State | PUBLISHED |
| Assigner | adobe |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-13 19:21:43 UTC |
| Updated | 2026-10-15 11:18:04 UTC |
| Description | Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. |
Risk And Classification
Primary CVSS: v3.1 9.1 CRITICAL from [email protected]
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Problem Types: CWE-20 | CWE-20 Improper Input Validation (CWE-20)
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 9.1 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 9.1 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
HighUser Interaction
NoneScope
ChangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Adobe | Adobe Commerce | affected 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep custom | Not specified |
| CNA | Adobe | Adobe Commerce | unaffected 2.4.10-alpha1,2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-oct custom | Not specified |
| CNA | Adobe | Adobe Commerce B2B | affected 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep custom | Not specified |
| CNA | Adobe | Adobe Commerce B2B | unaffected 1.5.4-alpha1,1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, 1.3.3-2026-oct custom | Not specified |
| CNA | Adobe | Magento Open Source | affected 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep custom | Not specified |
| CNA | Adobe | Magento Open Source | unaffected 2.4.10-alpha1,2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.adobe.com/trust/security/products/commerce/apsb26-153.html | [email protected] | www.adobe.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.