CVE-2026-34645: Adobe Commerce Auth Bypass Vulnerability

CVE-2026-34645 Overview

CVE-2026-34645 is an Incorrect Authorization vulnerability [CWE-863] affecting multiple versions of Adobe Commerce. The flaw allows a remote attacker to bypass security controls and obtain unauthorized write access to the application. Exploitation requires no authentication and no user interaction, and the attack is delivered over the network. Adobe addressed the issue in a security advisory published as APSB26-49.

Critical Impact

An unauthenticated network attacker can bypass authorization checks in Adobe Commerce and perform unauthorized write operations, compromising the integrity of storefront and back-office data.

Affected Products

• Adobe Commerce 2.4.9-beta1
• Adobe Commerce 2.4.8-p4, 2.4.7-p9, 2.4.6-p14
• Adobe Commerce 2.4.5-p16, 2.4.4-p17 and earlier

Discovery Timeline

• 2026-05-12 - CVE-2026-34645 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-34645

Vulnerability Analysis

The vulnerability stems from an Incorrect Authorization weakness [CWE-863] in Adobe Commerce. The application performs an authorization check, but the check does not correctly enforce the intended access policy. An attacker who reaches an affected endpoint can submit a request that the server processes despite the user lacking the privileges required to perform the action.

The issue is classified as a security feature bypass. Successful exploitation grants write access to resources that should be restricted, which can lead to tampering of catalog data, order data, configuration, or other server-side state. Adobe rates the integrity impact as high while confidentiality and availability remain unaffected, indicating the flaw is leveraged primarily to modify data rather than read it or disrupt service.

No public proof-of-concept exploit, ExploitDB entry, or CISA KEV listing exists at the time of publication. The EPSS probability is 0.093%, reflecting low observed exploitation activity.

Root Cause

The root cause is an authorization control that fails to validate the requesting principal against the resource or action being requested. Functions reachable over HTTP do not enforce the expected permission boundary, allowing a caller without the required role to invoke write operations.

Attack Vector

The attack vector is network-based with low complexity. The attacker sends a crafted HTTP request directly to a vulnerable Adobe Commerce endpoint. No credentials and no user interaction are required. Because the check is bypassable rather than absent, the request appears legitimate to downstream handlers and is committed to the application state.

No verified exploitation code is available. Refer to the Adobe Magento Security Advisory APSB26-49 for the vendor description.

Detection Methods for CVE-2026-34645

Indicators of Compromise

• Unexpected POST, PUT, or PATCH requests to administrative or API endpoints from unauthenticated sessions or untrusted source IP ranges.
• New or modified administrative users, products, CMS blocks, configuration entries, or payment method records with no corresponding entry in admin action logs.
• Web server access logs showing successful 2xx responses to write operations without a preceding authentication request chain.

Detection Strategies

• Compare authorization decisions in application logs against the authenticated principal for each write request, and alert on writes attributed to anonymous or low-privilege users.
• Baseline normal request patterns to /rest/, /graphql, and /admin paths, and flag deviations such as spikes in unauthenticated write requests.
• Apply a Web Application Firewall (WAF) rule set tuned for Adobe Commerce to detect known abuse patterns once vendor or community signatures become available.

Monitoring Recommendations

• Forward Adobe Commerce application logs, web server access logs, and database audit logs to a centralized analytics platform for correlation.
• Monitor file integrity on the Adobe Commerce installation directory and database schemas for unauthorized changes to configuration tables.
• Track outbound connections from the Commerce host to identify follow-on activity such as data exfiltration or webhook abuse after a successful bypass.

How to Mitigate CVE-2026-34645

Immediate Actions Required

• Inventory all Adobe Commerce instances and identify versions matching the affected list, including pre-production and staging environments.
• Apply the Adobe security update referenced in APSB26-49 on the next available maintenance window.
• Restrict network exposure of administrative and API endpoints to trusted source addresses until patching is complete.
• Review recent administrative and API activity for signs of unauthorized writes during the window in which the system was exposed.

Patch Information

Adobe released fixed versions for Adobe Commerce in the security bulletin APSB26-49. Administrators should upgrade to the patched release line that corresponds to their currently deployed branch. Refer to the Adobe Magento Security Advisory for exact patched version numbers and download locations.

Workarounds

• Place the Adobe Commerce admin and REST/GraphQL APIs behind a VPN or IP allowlist to reduce unauthenticated network exposure.
• Deploy WAF rules that block anonymous write requests to administrative and API URIs until the patch is applied.
• Enforce least privilege on integration accounts and rotate API tokens that may have been observed by an attacker.

# Example: restrict access to Adobe Commerce admin and API endpoints with nginx
location ~ ^/(admin|rest|graphql) {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    try_files $uri $uri/ /index.php?$args;
}