UpHeron
All posts

Critical vulnerability

Critical remote code execution in Magento / Adobe Commerce (CVE-2026-95631)

Remote code execution in Magento / Adobe Commerce · Servers and applications

CVE-2026-95631

Adobe Commerce | Improper Input Validation (CWE-20)

Severity
Critical 9.1
Published
13 Oct 2026
Fixed in
2.4.4, 2.4.7
Weakness
Improper input validation (CWE-20)

Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

From the CVE Program.
SoftwareAffected versions
Magento / Adobe CommerceServers and applications
  • Every version up to 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep
Magento / Adobe CommerceServers and applications
  • Every version up to 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep
Magento / Adobe CommerceServers and applications
  • Version 2.4.9
  • Version 2.4.9-beta1
  • Version 2.4.9-alpha3
  • Version 2.4.9-alpha2
Magento / Adobe CommerceServers and applications
  • Version 2.4.9
  • Version 2.4.9-beta1
  • Version 2.4.9-alpha3
  • Version 2.4.9-alpha2
  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-95631
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-95631
Everything about CVE-2026-95631

From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.