CVE-2026-34652: Adobe Commerce DoS Vulnerability

CVE-2026-34652 Overview

CVE-2026-34652 affects Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17, and earlier releases. The vulnerability stems from a dependency on a vulnerable third-party component that an attacker can abuse to trigger an application denial-of-service condition. Remote attackers can crash the Commerce application without authentication or user interaction. Adobe published the issue under security advisory APSB26-49.

Critical Impact

Unauthenticated remote attackers can crash Adobe Commerce storefront and admin services, disrupting online retail operations and order processing.

Affected Products

• Adobe Commerce 2.4.9-beta1
• Adobe Commerce 2.4.8-p4, 2.4.7-p9, 2.4.6-p14
• Adobe Commerce 2.4.5-p16, 2.4.4-p17 and earlier

Discovery Timeline

• 2026-05-12 - CVE-2026-34652 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-34652

Vulnerability Analysis

CVE-2026-34652 is a Denial of Service vulnerability rooted in a third-party library bundled with Adobe Commerce. The flaw is reachable over the network, requires no privileges, and needs no user interaction. Successful exploitation impacts availability only — confidentiality and integrity remain intact.

Adobe Commerce powers transactional storefronts, and an availability loss directly translates to lost revenue and degraded customer experience. The exposure spans the latest beta release and every supported maintenance branch back through 2.4.4-p17.

Root Cause

The root cause is a Dependency on Vulnerable Third-Party Component weakness. A library shipped with Adobe Commerce contains a known defect that crashes the hosting process or thread when supplied with adversarial input. Because the vulnerable component sits within the request-processing path, network-borne traffic can reach the defective code and terminate the application.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends crafted requests to an exposed Adobe Commerce endpoint, reaching the vulnerable third-party component embedded in the request pipeline. Repeated requests can sustain the outage and prevent legitimate transactions from completing.

No verified public proof-of-concept exists at publication time. Adobe has not reported active exploitation, and the issue is not listed on the CISA Known Exploited Vulnerabilities catalog. Refer to the Adobe Security Advisory APSB26-49 for vendor-supplied technical details.

Detection Methods for CVE-2026-34652

Indicators of Compromise

• Unexpected PHP-FPM, Nginx, or Apache worker crashes coinciding with inbound traffic spikes
• Repeated 5xx responses from /rest, /graphql, or storefront controllers
• Abnormally large or malformed request bodies preceding service restarts
• Sudden drops in checkout completion and session counts in commerce analytics

Detection Strategies

• Correlate web server access logs with application error logs to identify request patterns that precede crashes
• Baseline normal request volume to Commerce endpoints and alert on anomalous bursts from single sources
• Monitor var/log/exception.log and system.log for repeated stack traces tied to third-party libraries

Monitoring Recommendations

• Track process uptime and restart counts for PHP-FPM and the underlying web server
• Forward Commerce application logs to a centralized logging or SIEM platform for retention and correlation
• Enable alerting on consecutive HTTP 502/503/504 responses from upstream Commerce nodes

How to Mitigate CVE-2026-34652

Immediate Actions Required

• Apply the Adobe Commerce security update referenced in APSB26-49 to all affected instances
• Inventory all Adobe Commerce deployments, including staging and development, and confirm patch coverage
• Place a web application firewall (WAF) in front of Commerce nodes to filter malformed requests

Patch Information

Adobe addressed CVE-2026-34652 in the maintenance releases listed in security bulletin APSB26-49. Administrators should upgrade Adobe Commerce to the fixed versions provided by Adobe and validate that the bundled third-party component has been updated. Review the Adobe Security Advisory APSB26-49 for the exact target versions and upgrade procedure.

Workarounds

• Rate-limit unauthenticated requests to Commerce REST and GraphQL endpoints at the edge or WAF layer
• Deploy upstream request validation rules to reject malformed payloads targeting the vulnerable component
• Configure automatic process supervision to restart crashed PHP-FPM workers while patching is scheduled

# Example Nginx rate-limit configuration for Adobe Commerce endpoints
http {
    limit_req_zone $binary_remote_addr zone=commerce_api:10m rate=20r/s;

    server {
        location /rest/ {
            limit_req zone=commerce_api burst=40 nodelay;
            proxy_pass http://commerce_upstream;
        }

        location /graphql {
            limit_req zone=commerce_api burst=40 nodelay;
            client_max_body_size 1m;
            proxy_pass http://commerce_upstream;
        }
    }
}