CVE-2026-47984: Adobe Commerce Auth Bypass Vulnerability

CVE-2026-47984 Overview

CVE-2026-47984 is an incorrect authorization vulnerability [CWE-863] affecting Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe I/O Events connector for Commerce. An unauthenticated attacker can bypass authorization checks over the network to gain unauthorized read and write access to protected resources. Exploitation requires no user interaction and no privileges, which makes internet-exposed Commerce storefronts and admin endpoints prime targets. Adobe published the security advisory APSB26-73 covering this issue on July 14, 2026.

Critical Impact
An unauthenticated network attacker can bypass Adobe Commerce authorization controls to read and modify protected data without any user interaction.

Affected Products

Adobe Commerce versions 2.4.4 through 2.4.9 (including all published patch levels)
Adobe Commerce B2B versions 1.3.3, 1.3.4, 1.4.2, 1.5.2, and 1.5.3
Magento Open Source 2.4.6, 2.4.7, 2.4.8, and 2.4.9, plus the Adobe I/O Events connector for Commerce

Discovery Timeline

2026-07-14 - CVE-2026-47984 published to NVD and Adobe releases advisory APSB26-73
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-47984

Vulnerability Analysis

CVE-2026-47984 is classified under [CWE-863] Incorrect Authorization. The affected Commerce components perform an authorization decision that does not correctly enforce the intended access policy. As a result, requests that should be rejected are permitted to read and write protected data. Because the flaw is exposed over the network without authentication or user interaction, an attacker can drive exploitation directly against a public storefront or API endpoint.

The impact spans confidentiality and integrity of Commerce data, including customer records, orders, and configuration accessible through the vulnerable code path. Availability is not directly affected, but write access allows an attacker to tamper with business-critical objects. Adobe rates the issue as a security feature bypass, consistent with an authorization check that can be circumvented rather than a code execution primitive.

Root Cause

The root cause is an incorrect authorization check inside affected Commerce, Commerce B2B, Magento, and I/O Events components. The vulnerable code accepts a request context that grants access it should have denied. This class of flaw commonly arises from missing role validation on an API route, reliance on client-supplied identifiers, or an incomplete server-side check on a privileged operation.

Attack Vector

Exploitation is remote and unauthenticated. An attacker crafts a network request to a vulnerable Commerce endpoint that triggers the flawed authorization path. Because no privileges or user interaction are required, the vulnerability is suitable for automated, opportunistic scanning against exposed Commerce deployments. Refer to the Adobe Magento Security Advisory APSB26-73 for vendor-provided technical context.

Detection Methods for CVE-2026-47984

Indicators of Compromise

Unexpected successful HTTP responses on Commerce REST, GraphQL, or admin endpoints from unauthenticated clients or unusual source IPs.
Unauthorized modifications to customer, order, catalog, or configuration data with no corresponding administrator session in the audit log.
New or altered administrative users, integration tokens, or webhook subscriptions that were not created through legitimate change management.

Detection Strategies

Baseline authenticated versus unauthenticated request patterns for /rest/, /graphql, and /admin routes and alert on deviations that suggest authorization bypass.
Correlate write operations on protected entities with authenticated session identifiers to surface writes that lack a valid session.
Compare deployed Commerce, Commerce B2B, Magento, and Adobe I/O Events versions against the fixed builds listed in APSB26-73 to identify vulnerable hosts.

Monitoring Recommendations

Forward web server, application, and Commerce admin audit logs to a centralized analytics platform for continuous review.
Monitor outbound connections from Commerce hosts for unexpected data egress that could indicate exfiltration following bypass.
Enable alerting on privileged Commerce API calls such as user creation, permission changes, and integration token issuance.

How to Mitigate CVE-2026-47984

Immediate Actions Required

Apply the fixed versions listed in Adobe security bulletin APSB26-73 to all Commerce, Commerce B2B, Magento Open Source, and Adobe I/O Events deployments.
Inventory all internet-exposed Commerce endpoints and prioritize patching of storefronts and APIs reachable from untrusted networks.
Rotate administrator credentials, API keys, and integration tokens on any host that cannot be immediately verified as unaffected.

Patch Information

Adobe addressed CVE-2026-47984 in the security update tracked as APSB26-73. Administrators should review the Adobe Magento Security Advisory for the specific fixed versions per product line and follow Adobe's documented upgrade procedure. After patching, validate that all previously vulnerable endpoints reject unauthenticated access.

Workarounds

Restrict access to Commerce admin and non-public API endpoints behind a VPN, IP allowlist, or web application firewall until patches are deployed.
Deploy WAF rules that block anomalous requests to sensitive Commerce routes and enforce authentication headers on protected paths.
Disable unused modules such as the Adobe I/O Events connector where they are not required for business operations.

bash

# Configuration example: verify installed Adobe Commerce version and apply the vendor patch
php bin/magento --version
composer require magento/product-community-edition=<fixed-version> --no-update
composer update
php bin/magento setup:upgrade
php bin/magento setup:di:compile
php bin/magento cache:flush