SB2026071509 - Multiple vulnerabilities in Adobe Commerce and Magento Open Source
Published: July 15, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 13 vulnerabilities.
1) Cross-site scripting (CVE-ID: CVE-2026-47999)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to cross-site scripting (stored xss) in stored content handling when rendering stored content. A remote privileged user can inject a malicious script to execute arbitrary code.
User interaction is required for exploitation.
2) Improper Encoding or Escaping of Output (CVE-ID: CVE-2026-48358)
CWE-ID: CWE-116 - Improper Encoding or Escaping of Output
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper encoding or escaping of output in webhooks when processing webhook data. A remote privileged user can trigger the flaw to execute arbitrary code.
Only webhooks are affected.
3) Cross-site scripting (CVE-ID: CVE-2026-47994)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to cross-site scripting (stored xss) in stored content handling when rendering stored content. A remote user can inject a malicious script to escalate privileges.
User interaction is required for exploitation.
4) Incorrect authorization (CVE-ID: CVE-2026-47988)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass security features.
The vulnerability exists due to incorrect authorization in an authorization mechanism when handling requests. A remote attacker can access restricted functionality to bypass security features.
5) Incorrect authorization (CVE-ID: CVE-2026-47984)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass security features.
The vulnerability exists due to incorrect authorization in an authorization mechanism when handling requests. A remote attacker can access restricted functionality to bypass security features.
6) Cross-site scripting (CVE-ID: CVE-2026-47995)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to cross-site scripting (stored xss) in stored content handling when rendering stored content. A remote privileged user can inject a malicious script to escalate privileges.
This issue is specific to B2B, and user interaction is required for exploitation.
7) Incorrect authorization (CVE-ID: CVE-2026-47996)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass security features.
The vulnerability exists due to incorrect authorization in an authorization mechanism when handling requests. A remote privileged user can access restricted functionality to bypass security features.
8) Input validation error (CVE-ID: CVE-2026-47992)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to improper input validation in an input validation routine when processing input. A remote privileged user can supply crafted input to escalate privileges.
9) Incorrect authorization (CVE-ID: CVE-2026-47997)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass security features.
The vulnerability exists due to incorrect authorization in an authorization mechanism when handling requests. A remote attacker can access restricted functionality to bypass security features.
10) Incorrect authorization (CVE-ID: CVE-2026-47998)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass security features.
The vulnerability exists due to incorrect authorization in an authorization mechanism when handling requests. A remote attacker can access restricted functionality to bypass security features.
11) Arbitrary file upload (CVE-ID: CVE-2026-48356)
CWE-ID: CWE-434 - Unrestricted Upload of File with Dangerous Type
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to escalate privileges.
The vulnerability exists due to unrestricted upload of file with dangerous type in file upload functionality when handling uploaded files. A remote attacker can upload a dangerous file to escalate privileges.
User interaction is required for exploitation.
12) Open redirect (CVE-ID: CVE-2026-48000)
CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass security features.
The vulnerability exists due to url redirection to untrusted site ('open redirect') in URL handling when processing a crafted link. A remote attacker can cause a victim to follow a crafted link to bypass security features.
User interaction is required for exploitation.
13) Information disclosure (CVE-ID: CVE-2026-48001)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to information exposure in an unspecified component when handling requests. A remote attacker can access exposed information to disclose sensitive information.
Remediation
Install update from vendor's website.