Open redirect in Adobe products - CVE-2026-48000

Vulnerability identifier: #VU137596

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-48000

CWE-ID: CWE-601

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass security features.

The vulnerability exists due to url redirection to untrusted site ('open redirect') in URL handling when processing a crafted link. A remote attacker can cause a victim to follow a crafted link to bypass security features.

User interaction is required for exploitation.

Adobe Commerce B2B
Magento Open Source
Adobe Commerce (formerly Magento Commerce)

Install security update from vendor's website.

Adobe Commerce B2B - addressed in versions 1.3.3-2026-jul, 1.3.4-2026-jul, 1.4.2-2026-jul, 1.5.2-2026-jul, 1.5.3-2026-jul
Magento Open Source - addressed in versions 2.4.6-2026-jul, 2.4.7-2026-jul, 2.4.8-2026-jul, 2.4.9-2026-jul
Adobe Commerce (formerly Magento Commerce) - addressed in versions 2.4.4-2026-jul, 2.4.5-2026-jul, 2.4.6-2026-jul, 2.4.7-2026-jul, 2.4.8-2026-jul, 2.4.9-2026-jul

• https://helpx.adobe.com/security/products/magento/apsb26-73.html
• https://helpx.adobe.com/security.html

• Multiple vulnerabilities in Adobe Commerce and Magento Open Source