CVE-2026-95631
8.7HighPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- High impact on integrity, availability
- Weakness
- CWE-20
Impact
Authenticated attackers with high privileges can execute arbitrary code on the host in the context of the running service account. They only need network access and high-privilege credentials; no user interaction is required.
Root cause
Improper input validation in Adobe Commerce allows malicious input to trigger arbitrary code execution.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
Fix & remediation
Upgrade Adobe Commerce to the fixed version documented in Adobe advisory APSB26-153. Restrict administrative access to trusted networks and audit high-privilege accounts if patching must wait.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.