CVE-2026-48001: Adobe Commerce | Information Exposure (CWE-200)

Description

Adobe Commerce is affected by an Information Exposure vulnerability that could lead to a limited disclosure of sensitive information. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack vector

Network

Complexity

High

Privileges

None

User interaction

None

Confidentiality

Low

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.5% · higher than 43% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

CO

Commerce · Adobe

through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 · source: vendor, NVD

AC

Adobe Commerce B2B · Adobe

through 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 · source: vendor

AC

Adobe Commerce Events · Adobe

through 1.20.0 · source: vendor

CB

Commerce B2b · Adobe

1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more · source: NVD

IE

I/o Events · Adobe

1.6.0 before 1.21.0 · source: NVD