Adobe Commerce B2B
Adobe- Product type
- Other
- Catalog vulnerabilities
- 64
Severity across 64 analyzed records
en
Verify to analyze this security profile
As of 09/13/2026, within CyStack's analyzed data, Adobe Commerce B2B has 30 security vulnerabilities published in the last 90 days. Of these, 21 are rated High or Critical. Notably, 1 of these vulnerabilities is listed in the CISA KEV catalog. CyStack recommends that organizations and individual users remediate applicable vulnerabilities as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Adobe Commerce B2B and determine which vulnerabilities affect that version.
| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-76200Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published09/08/2026 | SeverityCritical |
CVE-2026-76201Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published09/08/2026 | SeverityCritical |
CVE-2026-77109Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published09/08/2026 | SeverityHigh |
CVE-2026-77110Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | Exploitation statusNot known exploited | FixYes | Published09/08/2026 | SeverityHigh |
CVE-2026-77108Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published09/08/2026 | SeverityHigh |
CVE-2026-76202Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published09/08/2026 | SeverityHigh |
CVE-2026-77774Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published09/08/2026 | SeverityHigh |
CVE-2026-77111Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published09/08/2026 | SeverityHigh |
CVE-2026-75650Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) | Exploitation statusKEV | FixYes | Published09/07/2026 | SeverityCritical |
CVE-2026-48414Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published08/11/2026 | SeverityHigh |
CVE-2026-48416Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published08/11/2026 | SeverityHigh |
CVE-2026-48413Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published08/11/2026 | SeverityHigh |
CVE-2026-48415Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published08/11/2026 | SeverityHigh |
CVE-2026-48412Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published08/11/2026 | SeverityLow |
CVE-2026-48411Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published08/11/2026 | SeverityMedium |
CVE-2026-71362Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published08/11/2026 | SeverityCritical |
CVE-2026-47984Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityHigh |
CVE-2026-47997Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityMedium |
CVE-2026-47988Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityHigh |
CVE-2026-47999Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityMedium |
CVE-2026-48358Adobe Commerce | Improper Encoding or Escaping of Output (CWE-116) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityCritical |
CVE-2026-48356Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityCritical |
CVE-2026-47998Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityMedium |
CVE-2026-48000Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityMedium |
CVE-2026-47995Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityHigh |
CVE-2026-48001Adobe Commerce | Information Exposure (CWE-200) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityLow |
CVE-2026-48371Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityMedium |
CVE-2026-47996Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityMedium |
CVE-2026-47994Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityHigh |
CVE-2026-47992Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityHigh |
CVE-2026-34656Adobe Commerce | Improper Authorization (CWE-285) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityMedium |
CVE-2026-34658Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityMedium |
CVE-2026-34650Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityHigh |
CVE-2026-34686Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityHigh |
CVE-2026-34647Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityHigh |
CVE-2026-34685Adobe Commerce | Improper Input Validation (CWE-20) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityLow |
CVE-2026-34653Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityHigh |
CVE-2026-34652Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityHigh |
CVE-2026-34645Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityHigh |
CVE-2026-34648Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityHigh |
CVE-2026-34649Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityHigh |
CVE-2026-34655Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityMedium |
CVE-2026-34654Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityMedium |
CVE-2026-34651Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityHigh |
CVE-2026-34646Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published05/12/2026 | SeverityHigh |
CVE-2026-21291Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityMedium |
CVE-2026-21293Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityMedium |
CVE-2026-21282Adobe Commerce | Improper Input Validation (CWE-20) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityMedium |
CVE-2026-21286Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityMedium |
CVE-2026-21294Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityMedium |
CVE-2026-21284Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityHigh |
CVE-2026-21297Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityMedium |
CVE-2026-21359Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityMedium |
CVE-2026-21309Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityHigh |
CVE-2026-21292Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityMedium |
CVE-2026-21310Adobe Commerce | Improper Input Validation (CWE-20) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityMedium |
CVE-2026-21285Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityMedium |
CVE-2026-21290Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityHigh |
CVE-2026-21289Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityHigh |
CVE-2026-21361Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityHigh |
CVE-2026-21360Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityMedium |
CVE-2026-21296Adobe Commerce | Incorrect Authorization (CWE-863) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityMedium |
CVE-2026-21311Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityHigh |
CVE-2026-21295Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) | Exploitation statusNot known exploited | FixYes | Published03/11/2026 | SeverityLow |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan