CVE-2026-48001: Adobe Commerce information exposure vulnerability

CVE-2026-48001 · Severity: low · CVSS 3.7 · Published 2026-07-14

Adobe Commerce and Magento, popular e-commerce platforms used for online storefronts, are affected by a vulnerability that could allow the disclosure of sensitive information. An attacker could potentially access data they are not authorized to see, though the exploit requires specific conditions outside of the attacker's direct control. This issue does not require any interaction from a legitimate user to be exploited.

Technologies: Adobe Commerce, Adobe Commerce Webhooks Plugin, Adobe Commerce B2b, Adobe Magento Open Source. Vendors: Adobe.

Quick answers

Is CVE-2026-48001 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48001 being exploited in the wild.
How severe is CVE-2026-48001?
Low severity, with a CVSS score of 3.7, published 14 July 2026.
Which products and versions are affected?
Adobe Commerce <= 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18; Adobe Commerce Webhooks Plugin <= 1.20.0; Adobe Commerce B2b <= 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18; Adobe Magento Open Source <= 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15.
Is there a fix for CVE-2026-48001?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-48001 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-48001?
Check whether you run Adobe Commerce, Adobe Commerce Webhooks Plugin, Adobe Commerce B2b or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Adobe Commerce and Magento Open Source are vulnerable to an information exposure (CWE-200) flaw. The vulnerability allows an unauthenticated attacker to potentially access sensitive information over the network. Exploitation is considered difficult (AC:H) as it depends on specific environmental conditions or configurations beyond the attacker's direct control. No user interaction is required for successful exploitation. Adobe has released security updates to address this issue across multiple versions of Commerce, Magento Open Source, and the Webhooks Plugin.

Affected products

  • Adobe Adobe Commerce <= 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18
  • Adobe Adobe Commerce B2B <= 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18
  • Adobe Magento Open Source <= 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15
  • Adobe Adobe Commerce Webhooks Plugin <= 1.20.0

Timeline

  • 2026-07-14: disclosed
  • 2026-07-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.