Priority MEDIUM 43
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields.
CVSS 3.1CRITICAL 9.3· Network · No auth · User interaction · EPSS 0.00744 · Published 2026-09-08 · Fixed in 2.4.9-2026-sep, 2.4.8-2026-sep +9 CWE-79
Priority MEDIUM 43
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields.
CVSS 3.1CRITICAL 9.3· Network · No auth · User interaction · EPSS 0.00744 · Published 2026-09-08 · Fixed in 2.4.9-2026-sep, 2.4.8-2026-sep +9 CWE-79
Priority MEDIUM 46
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.0069 · Published 2026-09-08 · Fixed in 2.4.9-2026-sep, 2.4.8-2026-sep +9 CWE-863
Priority LOW 35
Adobe Commerce is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass.
CVSS 3.1HIGH 7.6· Network · High privileges · No interaction · EPSS 0.01094 · Published 2026-09-08 · Fixed in 2.4.9-2026-sep, 2.4.8-2026-sep +9 CWE-22
Priority MEDIUM 40
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0082 · Published 2026-09-08 · Fixed in 2.4.9-2026-sep, 2.4.8-2026-sep +9 CWE-863
Priority MEDIUM 45
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.00673 · Published 2026-09-08 · Fixed in 2.4.9-2026-sep, 2.4.8-2026-sep +9 CWE-863
Priority MEDIUM 45
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.00829 · Published 2026-09-08 · Fixed in 2.4.9-2026-sep, 2.4.8-2026-sep +9 CWE-863
Priority LOW 39
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass.
CVSS 3.1HIGH 8.7· Network · High privileges · No interaction · EPSS 0.00842 · Published 2026-09-08 · Fixed in 2.4.9-2026-sep, 2.4.8-2026-sep +9 CWE-863
THREATIST.IORead the docs