UpHeron
All vulnerabilities

Servers and applications

CVE-2026-48412

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to restricted resources. Exploitation of this issue does not require user interaction.

Severity
High 7.2
Published
11 Aug 2026
Last changed
25 Sept 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Magento / Adobe CommerceServers and applications · cpe:a:adobe:commerce
  • Version 2.4.9
  • Version 2.4.8-p5
  • Version 2.4.8-p4
  • Version 2.4.8-p3
All 66 release lines
  • Version 2.4.4-p1
  • Version 2.4.4-p2
  • Version 2.4.4-p3
  • Version 2.4.4-p4
  • Version 2.4.4-p5
  • Version 2.4.4-p6
  • Version 2.4.4-p7
  • Version 2.4.4-p8
  • Version 2.4.4-p9
  • Version 2.4.4-p10
  • Version 2.4.4-p11
  • Version 2.4.4-p12
  • Version 2.4.4-p13
  • Version 2.4.4-p14
  • Version 2.4.4-p15
  • Version 2.4.4-p16
  • Version 2.4.4-p17
  • Version 2.4.4-p18
  • Version 2.4.5-p1
  • Version 2.4.5-p2
  • Version 2.4.5-p3
  • Version 2.4.5-p4
  • Version 2.4.5-p5
  • Version 2.4.5-p6
  • Version 2.4.5-p7
  • Version 2.4.5-p8
  • Version 2.4.5-p9
  • Version 2.4.5-p10
  • Version 2.4.5-p11
  • Version 2.4.5-p12
  • Version 2.4.5-p13
  • Version 2.4.5-p14
  • Version 2.4.5-p15
  • Version 2.4.5-p16
  • Version 2.4.5-p17
  • Version 2.4.6-p1
  • Version 2.4.6-p2
  • Version 2.4.6-p3
  • Version 2.4.6-p4
  • Version 2.4.6-p5
  • Version 2.4.6-p6
  • Version 2.4.6-p7
  • Version 2.4.6-p8
  • Version 2.4.6-p9
  • Version 2.4.6-p10
  • Version 2.4.6-p11
  • Version 2.4.6-p12
  • Version 2.4.6-p13
  • Version 2.4.6-p14
  • Version 2.4.6-p15
  • Version 2.4.7-p1
  • Version 2.4.7-p2
  • Version 2.4.7-p3
  • Version 2.4.7-p4
  • Version 2.4.7-p5
  • Version 2.4.7-p6
  • Version 2.4.7-p7
  • Version 2.4.7-p8
  • Version 2.4.7-p9
  • Version 2.4.7-p10
  • Version 2.4.8-p1
  • Version 2.4.8-p2
  • Version 2.4.8-p3
  • Version 2.4.8-p4
  • Version 2.4.8-p5
  • Version 2.4.9
Magento / Adobe CommerceServers and applications · cpe:a:adobe:magento
  • Version 2.4.9
  • Version 2.4.8-p5
  • Version 2.4.8-p4
  • Version 2.4.8-p3
All 31 release lines
  • Version 2.4.6-p1
  • Version 2.4.6-p2
  • Version 2.4.6-p3
  • Version 2.4.6-p4
  • Version 2.4.6-p5
  • Version 2.4.6-p6
  • Version 2.4.6-p7
  • Version 2.4.6-p8
  • Version 2.4.6-p9
  • Version 2.4.6-p10
  • Version 2.4.6-p11
  • Version 2.4.6-p12
  • Version 2.4.6-p13
  • Version 2.4.6-p14
  • Version 2.4.6-p15
  • Version 2.4.7-p1
  • Version 2.4.7-p2
  • Version 2.4.7-p3
  • Version 2.4.7-p4
  • Version 2.4.7-p5
  • Version 2.4.7-p6
  • Version 2.4.7-p7
  • Version 2.4.7-p8
  • Version 2.4.7-p9
  • Version 2.4.7-p10
  • Version 2.4.8-p1
  • Version 2.4.8-p2
  • Version 2.4.8-p3
  • Version 2.4.8-p4
  • Version 2.4.8-p5
  • Version 2.4.9

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-48412
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-48412