CVE-2026-34650: Adobe Commerce DoS Vulnerability

CVE-2026-34650 Overview

CVE-2026-34650 is an uncontrolled resource consumption vulnerability [CWE-400] affecting Adobe Commerce. The flaw allows a remote, unauthenticated attacker to exhaust system resources and trigger an application denial-of-service condition. Exploitation requires no user interaction and is reachable over the network.

The issue affects Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17, and earlier. Adobe addressed the vulnerability in security advisory APSB26-49.

Critical Impact

An unauthenticated network attacker can exhaust Adobe Commerce resources to render storefronts and admin interfaces unavailable.

Affected Products

• Adobe Commerce 2.4.9-beta1
• Adobe Commerce 2.4.8-p4, 2.4.7-p9, 2.4.6-p14
• Adobe Commerce 2.4.5-p16, 2.4.4-p17 and earlier

Discovery Timeline

• 2026-05-12 - CVE-2026-34650 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-34650

Vulnerability Analysis

The vulnerability is classified under [CWE-400] Uncontrolled Resource Consumption. Adobe Commerce fails to properly limit resources allocated when processing certain attacker-controlled inputs. An attacker can repeatedly invoke the affected functionality to exhaust CPU, memory, or other backend resources.

The outcome is an availability impact only. Confidentiality and integrity of stored data are not affected by this issue. However, an exhausted application stops serving legitimate users, which directly impacts revenue for e-commerce deployments.

The vulnerability is reachable over the network without authentication or user interaction. The Adobe Security Bulletin APSB26-49 lists this issue alongside other Commerce flaws addressed in the same release cycle.

Root Cause

Adobe has not published low-level technical details of the resource consumption pattern. The CWE-400 classification indicates that the application does not enforce sufficient limits on allocation, recursion, iteration, or external request handling within the affected code paths. Refer to the Adobe Security Advisory APSB26-49 for vendor-confirmed details.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends crafted HTTP requests to exposed Adobe Commerce endpoints. Repeated or amplified requests drive resource consumption until the application stops responding. No credentials, user interaction, or prior foothold are required.

No public proof-of-concept exploit is available at the time of publication. The EPSS probability is low at the date of the enriched data, but availability of patches and the unauthenticated network reach warrant prompt remediation.

Detection Methods for CVE-2026-34650

Indicators of Compromise

• Sudden spikes in PHP-FPM, MySQL, or web server CPU and memory utilization on Adobe Commerce hosts without a corresponding increase in legitimate traffic.
• Elevated rates of 5xx HTTP responses, request timeouts, or worker pool exhaustion in front-end load balancers and reverse proxies.
• Repeated requests from a small set of source IPs targeting the same Commerce endpoint with anomalous payload sizes or parameters.

Detection Strategies

• Baseline normal request rates per endpoint and alert on statistically significant deviations originating from single sources or small IP ranges.
• Correlate web server access logs with backend resource metrics to identify request patterns that precede saturation events.
• Monitor application logs for repeated handler invocations, long-running requests, and queue backlogs tied to specific Commerce modules.

Monitoring Recommendations

• Forward web server, application, and database telemetry to a centralized analytics platform for cross-source correlation.
• Enable rate limiting and request anomaly alerts at the web application firewall (WAF) or content delivery network (CDN) layer.
• Track availability service level objectives for storefront and admin URLs and alert on degradation before full outage.

How to Mitigate CVE-2026-34650

Immediate Actions Required

• Apply the security updates referenced in Adobe Security Advisory APSB26-49 to all affected Adobe Commerce instances.
• Inventory all Commerce deployments, including staging and pre-production, and confirm patched versions are running.
• Place affected storefronts behind a WAF or CDN with rate limiting enabled until patching completes.

Patch Information

Adobe released fixed builds for the affected 2.4.x branches as documented in advisory APSB26-49. Administrators should upgrade to the latest patch level for their supported branch. Review the advisory for the exact fixed version mapping and any required composer or deployment steps.

Workarounds

• Enforce strict request rate limits and concurrency caps on Commerce endpoints at the WAF, CDN, or reverse proxy layer.
• Restrict access to administrative endpoints by source IP allowlists where feasible.
• Tune PHP-FPM, web server, and database connection pool limits to fail fast under abusive load rather than cascading failures.

# Example nginx rate limit for an Adobe Commerce front-end
limit_req_zone $binary_remote_addr zone=commerce_rl:10m rate=20r/s;

server {
    listen 443 ssl;
    server_name shop.example.com;

    location / {
        limit_req zone=commerce_rl burst=40 nodelay;
        limit_conn_status 429;
        proxy_pass http://commerce_backend;
    }
}