Adobe Commerce
Adobe- Product type
- Other
- Catalog vulnerabilities
- 199
Severity across 100 analyzed records
en
Verify to analyze this security profile
As of 09/13/2026, within CyStack's analyzed data, Adobe Commerce has 30 security vulnerabilities published in the last 90 days. Of these, 21 are rated High or Critical. Notably, 1 of these vulnerabilities is listed in the CISA KEV catalog. CyStack recommends that organizations and individual users remediate applicable vulnerabilities as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Adobe Commerce and determine which vulnerabilities affect that version.
| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-76200Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published09/08/2026 | SeverityCritical |
CVE-2026-76201Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published09/08/2026 | SeverityCritical |
CVE-2026-77109Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published09/08/2026 | SeverityHigh |
CVE-2026-77110Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | Exploitation statusNot known exploited | FixYes | Published09/08/2026 | SeverityHigh |
CVE-2026-77108Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published09/08/2026 | SeverityHigh |
CVE-2026-76202Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published09/08/2026 | SeverityHigh |
CVE-2026-77774Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published09/08/2026 | SeverityHigh |
CVE-2026-77111Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published09/08/2026 | SeverityHigh |
CVE-2026-75650Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) | Exploitation statusKEV | FixYes | Published09/07/2026 | SeverityCritical |
CVE-2026-48414Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published08/11/2026 | SeverityHigh |
CVE-2026-48416Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published08/11/2026 | SeverityHigh |
CVE-2026-48413Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published08/11/2026 | SeverityHigh |
CVE-2026-48415Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published08/11/2026 | SeverityHigh |
CVE-2026-48412Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published08/11/2026 | SeverityLow |
CVE-2026-48411Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published08/11/2026 | SeverityMedium |
CVE-2026-71362Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published08/11/2026 | SeverityCritical |
CVE-2026-47984Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityHigh |
CVE-2026-47997Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityMedium |
CVE-2026-47988Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityHigh |
CVE-2026-47999Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityMedium |
CVE-2026-48358Adobe Commerce | Improper Encoding or Escaping of Output (CWE-116) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityCritical |
CVE-2026-48356Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityCritical |
CVE-2026-47998Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityMedium |
CVE-2026-48000Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityMedium |
CVE-2026-47995Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityHigh |
CVE-2026-48001Adobe Commerce | Information Exposure (CWE-200) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityLow |
CVE-2026-48371Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityMedium |
CVE-2026-47996Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityMedium |
CVE-2026-47994Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityHigh |
CVE-2026-47992Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityHigh |
CVE-2026-34656Adobe Commerce | Improper Authorization (CWE-285) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityMedium |
CVE-2026-34658Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityMedium |
CVE-2026-34650Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityHigh |
CVE-2026-34686Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityHigh |
CVE-2026-34647Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityHigh |
CVE-2026-34685Adobe Commerce | Improper Input Validation (CWE-20) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityLow |
CVE-2026-34653Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityHigh |
CVE-2026-34652Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityHigh |
CVE-2026-34645Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityHigh |
CVE-2026-34648Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityHigh |
CVE-2026-34649Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityHigh |
CVE-2026-34655Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityMedium |
CVE-2026-34654Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityMedium |
CVE-2026-34651Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityHigh |
CVE-2026-34646Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityHigh |
CVE-2026-21291Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityMedium |
CVE-2026-21293Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityMedium |
CVE-2026-21282Adobe Commerce | Improper Input Validation (CWE-20) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityMedium |
CVE-2026-21286Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityMedium |
CVE-2026-21294Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityMedium |
CVE-2026-21284Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityHigh |
CVE-2026-21297Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityMedium |
CVE-2026-21359Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityMedium |
CVE-2026-21309Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityHigh |
CVE-2026-21292Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityMedium |
CVE-2026-21310Adobe Commerce | Improper Input Validation (CWE-20) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityMedium |
CVE-2026-21285Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityMedium |
CVE-2026-21290Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityHigh |
CVE-2026-21289Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityHigh |
CVE-2026-21361Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityHigh |
CVE-2026-21360Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityMedium |
CVE-2026-21296Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityMedium |
CVE-2026-21311Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityHigh |
CVE-2026-21295Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityLow |
CVE-2025-54267Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixNot confirmed | Published10/14/2025 | SeverityMedium |
CVE-2025-54266Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixNot confirmed | Published10/14/2025 | SeverityMedium |
CVE-2025-54263Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixNot confirmed | Published10/14/2025 | SeverityHigh |
CVE-2025-54265Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixNot confirmed | Published10/14/2025 | SeverityMedium |
CVE-2025-54264Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixNot confirmed | Published10/14/2025 | SeverityHigh |
CVE-2025-54236Adobe Commerce | Improper Input Validation (CWE-20) | Exploitation statusKEV | FixNot confirmed | Published09/09/2025 | SeverityCritical |
CVE-2025-49556Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixNot confirmed | Published08/12/2025 | SeverityHigh |
CVE-2025-49557Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixNot confirmed | Published08/12/2025 | SeverityHigh |
CVE-2025-49558Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) | Exploitation statusNot known exploited | FixNot confirmed | Published08/12/2025 | SeverityMedium |
CVE-2025-49554Adobe Commerce | Improper Input Validation (CWE-20) | Exploitation statusNot known exploited | FixNot confirmed | Published08/12/2025 | SeverityHigh |
CVE-2025-49559Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | Exploitation statusNot known exploited | FixNot confirmed | Published08/12/2025 | SeverityMedium |
CVE-2025-49555Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352) | Exploitation statusNot known exploited | FixNot confirmed | Published08/12/2025 | SeverityHigh |
CVE-2025-49550Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixNot confirmed | Published06/25/2025 | SeverityMedium |
CVE-2025-49549Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixNot confirmed | Published06/25/2025 | SeverityLow |
CVE-2025-27206Adobe Commerce | Improper Access Control (CWE-284) | Exploitation statusNot known exploited | FixNot confirmed | Published06/10/2025 | SeverityMedium |
CVE-2025-43586Adobe Commerce | Improper Access Control (CWE-284) | Exploitation statusNot known exploited | FixNot confirmed | Published06/10/2025 | SeverityHigh |
CVE-2025-47110Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixNot confirmed | Published06/10/2025 | SeverityHigh |
CVE-2025-27207Adobe Commerce | Improper Access Control (CWE-284) | Exploitation statusNot known exploited | FixNot confirmed | Published06/10/2025 | SeverityMedium |
CVE-2025-43585Adobe Commerce | Improper Authorization (CWE-285) | Exploitation statusNot known exploited | FixNot confirmed | Published06/10/2025 | SeverityHigh |
CVE-2025-27190Adobe Commerce | Improper Access Control (CWE-284) | Exploitation statusNot known exploited | FixNot confirmed | Published04/08/2025 | SeverityMedium |
CVE-2025-27191Adobe Commerce | Improper Access Control (CWE-284) | Exploitation statusNot known exploited | FixNot confirmed | Published04/08/2025 | SeverityMedium |
CVE-2025-27192Adobe Commerce | Insufficiently Protected Credentials (CWE-522) | Exploitation statusNot known exploited | FixNot confirmed | Published04/08/2025 | SeverityLow |
CVE-2025-27188Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixNot confirmed | Published04/08/2025 | SeverityMedium |
CVE-2025-27189Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352) | Exploitation statusNot known exploited | FixNot confirmed | Published04/08/2025 | SeverityMedium |
CVE-2025-24422Adobe Commerce | Improper Access Control (CWE-284) | Exploitation statusNot known exploited | FixNot confirmed | Published02/11/2025 | SeverityMedium |
CVE-2025-24414Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixNot confirmed | Published02/11/2025 | SeverityHigh |
CVE-2025-24437Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixNot confirmed | Published02/11/2025 | SeverityMedium |
CVE-2025-24434Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixNot confirmed | Published02/11/2025 | SeverityCritical |
CVE-2025-24415Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixNot confirmed | Published02/11/2025 | SeverityHigh |
CVE-2025-24411Adobe Commerce | Improper Access Control (CWE-284) | Exploitation statusNot known exploited | FixNot confirmed | Published02/11/2025 | SeverityHigh |
CVE-2025-24416Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixNot confirmed | Published02/11/2025 | SeverityHigh |
CVE-2025-24420Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixNot confirmed | Published02/11/2025 | SeverityMedium |
CVE-2025-24413Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixNot confirmed | Published02/11/2025 | SeverityHigh |
CVE-2025-24419Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixNot confirmed | Published02/11/2025 | SeverityMedium |
CVE-2025-24432Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) | Exploitation statusNot known exploited | FixNot confirmed | Published02/11/2025 | SeverityLow |
CVE-2025-24424Adobe Commerce | Improper Access Control (CWE-284) | Exploitation statusNot known exploited | FixNot confirmed | Published02/11/2025 | SeverityMedium |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan