CVE-2026-34649: Adobe Commerce DoS Vulnerability

CVE-2026-34649 Overview

CVE-2026-34649 is an Uncontrolled Resource Consumption vulnerability [CWE-400] affecting multiple versions of Adobe Commerce. The flaw allows an unauthenticated remote attacker to exhaust system resources, producing an application denial-of-service (DoS) condition. Exploitation requires no user interaction and no privileges, making the issue reachable from the network against any exposed Adobe Commerce storefront or admin endpoint. Adobe addressed the issue in security advisory APSB26-49.

Critical Impact
An unauthenticated attacker can remotely exhaust resources on affected Adobe Commerce deployments, taking the application offline without authentication or user interaction.

Affected Products

Adobe Commerce 2.4.9-beta1
Adobe Commerce 2.4.8-p4, 2.4.7-p9, 2.4.6-p14
Adobe Commerce 2.4.5-p16, 2.4.4-p17 and earlier

Discovery Timeline

2026-05-12 - CVE-2026-34649 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-34649

Vulnerability Analysis

The issue is classified as Uncontrolled Resource Consumption [CWE-400]. Adobe Commerce processes attacker-supplied input on a network-reachable code path without enforcing adequate bounds on the resources that the request can allocate. Repeated or crafted requests cause the application to consume CPU, memory, threads, or backend database connections until legitimate traffic can no longer be served. The advisory confirms the impact is limited to availability, with no confidentiality or integrity consequences.

Root Cause

The root cause is missing or insufficient resource limits on a request-handling path within Adobe Commerce. When the application fails to cap the amount of work performed per request, an attacker can drive resource usage well beyond expected operating ranges. Adobe has not publicly identified the specific module or endpoint. Refer to the Adobe Security Advisory APSB26-49 for vendor-supplied technical context.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends crafted requests to an exposed Adobe Commerce instance to trigger the resource-exhausting code path. Because no privileges are required, any internet-reachable storefront is in scope. No public proof-of-concept or in-the-wild exploitation has been reported, and the issue is not listed in CISA KEV.

No verified exploitation code is publicly available. See the Adobe Security Advisory APSB26-49 for vendor details.

Detection Methods for CVE-2026-34649

Indicators of Compromise

Sudden, sustained spikes in CPU, memory, or PHP-FPM worker usage on Adobe Commerce application servers without a corresponding increase in legitimate orders or sessions.
High volumes of similar HTTP requests from a small set of source IPs targeting the same Adobe Commerce endpoint.
Database connection pool saturation, slow-query backlog, or Redis/Varnish backend timeouts originating from the Commerce application tier.

Detection Strategies

Baseline normal request rates and resource utilization per endpoint, then alert on deviations consistent with resource-exhaustion behavior.
Inspect web server and application logs for repeated requests to a single URI returning elevated response times or 5xx errors.
Correlate WAF, load balancer, and application telemetry to identify low-volume but high-cost request patterns characteristic of algorithmic DoS.

Monitoring Recommendations

Monitor Adobe Commerce var/log/ files and PHP-FPM slow logs for long-running requests and worker exhaustion.
Track upstream timeouts and 5xx error ratios at the reverse proxy (Nginx, Varnish) to detect application stalls early.
Forward web, application, and infrastructure logs to a centralized analytics platform to support cross-source correlation during incident triage.

How to Mitigate CVE-2026-34649

Immediate Actions Required

Inventory all Adobe Commerce instances and identify versions matching those listed in APSB26-49.
Apply the Adobe Commerce security update referenced in APSB26-49 to all affected environments.
Restrict direct network exposure of Adobe Commerce admin endpoints and place storefronts behind a WAF capable of rate limiting.

Patch Information

Adobe released fixed builds for Adobe Commerce in Security Advisory APSB26-49. Administrators should upgrade to the patched releases that supersede 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, and 2.4.4-p17. Verify the post-patch version using the Adobe Commerce admin panel or bin/magento --version.

Workarounds

Enforce per-IP and per-endpoint rate limiting at the WAF or reverse proxy to cap request rates against expensive Commerce endpoints.
Tune PHP-FPM worker counts, request timeouts, and database connection limits to fail fast under abusive load rather than queueing indefinitely.
Place Adobe Commerce behind a CDN or edge protection service that can absorb volumetric and application-layer DoS traffic until patching is complete.

bash

# Example Nginx rate-limit configuration for an Adobe Commerce upstream
limit_req_zone $binary_remote_addr zone=commerce_rl:10m rate=10r/s;

server {
    listen 443 ssl;
    server_name store.example.com;

    location / {
        limit_req zone=commerce_rl burst=20 nodelay;
        proxy_read_timeout 15s;
        proxy_send_timeout 15s;
        proxy_pass http://commerce_backend;
    }
}