Skip to content
OpenAdvisories
High NCSC-2026-0152 6 CVEs

Kwetsbaarheden verholpen in Adobe Commerce

Published May 13, 2026 · Updated May 13, 2026 · nl

Vendor: Adobe Product: Commerce Product: Commerce B2B Product: Magento Open Source

Summary

Adobe heeft meerdere kwetsbaarheden verholpen in Adobe Commerce.

Details

Interpretaties
De kwetsbaarheden bevinden zich in verschillende versies van Adobe Commerce, waaronder 2.4.9-beta1 en eerdere versies. Een Incorrect Authorization kwetsbaarheid maakt het mogelijk voor aanvallers om autorisatiecontroles te omzeilen en ongeautoriseerde schrijfrechten te verkrijgen zonder gebruikersinteractie. Daarnaast is er een Server-Side Request Forgery (SSRF) kwetsbaarheid die aanvallers in staat stelt beveiligingsmaatregelen te omzeilen en ongeautoriseerde leesrechten te verkrijgen door het serververzoek te manipuleren, waarvoor wel gebruikersinteractie via een kwaadaardige URL of webpagina nodig is. Verder is er een Uncontrolled Resource Consumption kwetsbaarheid die zonder gebruikersinteractie kan worden misbruikt om systeembronnen uit te putten, wat resulteert in een denial-of-service situatie die de beschikbaarheid van het Adobe Commerce platform beïnvloedt.

Oplossingen
Adobe heeft updates uitgebracht om de kwetsbaarheden in Adobe Commerce te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 6

  • High 7.5
    CVE-2026-34645

    Adobe Commerce | Incorrect Authorization (CWE-863)

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypa…

    Adobe Adobe Commerce Magento Open Source Adobe Commerce B2B Web / CMS
  • High 7.5
    CVE-2026-34646

    Adobe Commerce | Incorrect Authorization (CWE-863)

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypa…

    Adobe Adobe Commerce Magento Open Source Adobe Commerce B2B Web / CMS
  • High 7.5
    CVE-2026-34648 EPSS 21%

    Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerabil…

    Adobe Adobe Commerce Magento Open Source Adobe Commerce B2B Web / CMS
  • High 7.5
    CVE-2026-34649 EPSS 14%

    Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerabil…

    Adobe Adobe Commerce Magento Open Source Adobe Commerce B2B Web / CMS
  • High 7.5
    CVE-2026-34650 EPSS 15%

    Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerabil…

    Adobe Adobe Commerce Adobe Commerce B2B Magento Open Source Web / CMS
  • High 7.4
    CVE-2026-34647

    Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerabili…

    Adobe Adobe Commerce Adobe Commerce B2B Magento Open Source Web / CMS

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://helpx.adobe.com/security/products/magento/apsb26-49.html