Dependency on Vulnerable Third-Party Component in Adobe Commerce
CVE-2026-34652

7.5HIGH

Key Information:

Vendor

Adobe
Status
Adobe Commerce
Vendor
CVE Published:
12 May 2026

What is CVE-2026-34652?

A vulnerability exists in Adobe Commerce versions including 2.4.9-beta1 and earlier, relating to a dependency on a vulnerable third-party component. This issue may allow an attacker to exploit the system and crash the application, causing a denial-of-service situation. Notably, this exploitation can occur without needing any user interaction. Organizations utilizing these affected versions should assess their systems and implement necessary updates to mitigate potential risks.

Affected Version(s)

Adobe Commerce 0 <= 2.4.4-p17

References

https://helpx.adobe.com/security/products/magento/apsb26-...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.