Input validation error in Adobe products - CVE-2026-34685

Vulnerability identifier: #VU131242

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N]

CVE-ID: CVE-2026-34685

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to insufficient validation of user-supplied input. A remote privileged user can pass specially crafted input to the application and execute arbitrary code. 

Adobe Commerce B2B
Magento Open Source
Adobe Commerce (formerly Magento Commerce)

Install updates from vendor's website.

Adobe Commerce B2B - addressed in versions 1.3.3-p18, 1.3.4-p17, 1.4.2-p10, 1.5.2-p5, 1.5.3
Magento Open Source - addressed in versions 2.4.6-p15, 2.4.7-p10, 2.4.8-p5, 2.4.9
Adobe Commerce (formerly Magento Commerce) - addressed in versions 2.4.4-p18, 2.4.5-p17, 2.4.6-p15, 2.4.7-p10, 2.4.8-p5, 2.4.9

• https://helpx.adobe.com/security/products/magento/apsb26-49.html

• Multiple vulnerabilities in Adobe Commerce and Magento Open Source