Adobe · Code execution
This is rated critical severity (10 out of 10). There is no confirmed exploitation of it yet. Ask IT whether the affected products are in your estate.
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
Exploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality, integrity and availability, and it can reach beyond the vulnerable system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Exploitability
Longer bar: easier to attack
Impact
Longer bar: more harm
2 links from the CVE record, grouped by site.
adobe.com1 link
github.com1 link
Adobe Commerce is affected by a vulnerability that could allow arbitrary code execution in the context of store servers.
Who's reporting
Official authority missing. no OfficialVendor statement missing. no VendorResearcher coverage missing. no Researcher
No corroborated perspectives yet. Treat claims cautiously.
