CVE-2026-47997: Adobe Commerce Auth Bypass Vulnerability

CVE-2026-47997 Overview

CVE-2026-47997 is an Incorrect Authorization vulnerability [CWE-863] affecting Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe I/O Events module for Commerce. The flaw allows a remote, unauthenticated attacker to bypass security controls and gain unauthorized read access to protected resources. Exploitation does not require user interaction, but success depends on conditions beyond the attacker's direct control. Adobe published the fix through security advisory APSB26-73 on July 14, 2026.

Critical Impact
Successful exploitation enables unauthorized read access to confidential data within Adobe Commerce storefronts and back-office systems, potentially exposing customer, order, or configuration information.

Affected Products

Adobe Commerce versions 2.4.4 through 2.4.9 (including all patch releases)
Adobe Commerce B2B versions 1.3.3, 1.3.4, 1.4.2, 1.5.2, and 1.5.3
Magento Open Source 2.4.6 through 2.4.9 and Adobe I/O Events for Commerce

Discovery Timeline

2026-07-14 - Adobe releases security advisory APSB26-73 and patches
2026-07-14 - CVE-2026-47997 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-47997

Vulnerability Analysis

The vulnerability is classified under [CWE-863] Incorrect Authorization. Adobe Commerce enforces authorization checks that fail to correctly evaluate a caller's permissions before returning protected data. An attacker who can reach the vulnerable endpoint over the network can bypass the intended access controls without valid credentials. The result is unauthorized disclosure of information the application intended to restrict.

Exploitation is described by Adobe as conditional, meaning specific environmental or state-based prerequisites must be met. The impact is limited to confidentiality; the vulnerability does not permit modification of data or disruption of service. Because Adobe Commerce commonly stores customer records, order details, and merchant configuration, the disclosed data can be sensitive.

Root Cause

The root cause resides in the authorization logic used by Adobe Commerce to validate access to protected resources. The check either evaluates the wrong attribute, applies an incomplete policy, or trusts input that should have been re-validated on the server. When the check misfires, requests that should be rejected are processed and their responses returned to the caller.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted request to the vulnerable Commerce endpoint. When the specific pre-conditions align, the server returns data that should have required elevated privileges. The high attack complexity reflects the need for those pre-conditions to be present, which limits opportunistic exploitation but does not eliminate it in production storefronts exposed to the internet.

No public proof-of-concept code has been released for CVE-2026-47997. Refer to the Adobe Security Advisory APSB26-73 for vendor-provided technical guidance.

Detection Methods for CVE-2026-47997

Indicators of Compromise

Unexpected HTTP 200 responses to unauthenticated requests targeting REST or GraphQL endpoints that normally require a bearer token or admin session
Elevated volumes of requests to /rest/V1/, /graphql, or Adobe I/O Events webhook paths from a single source IP
Access log entries showing successful reads of customer, order, or configuration resources without a preceding authentication event

Detection Strategies

Correlate web server access logs with application authentication logs to surface authorized responses that lack a matching login event
Baseline normal API traffic patterns per endpoint and alert on statistical deviations in unauthenticated request volume
Deploy WAF rules that flag requests to sensitive Commerce API paths originating from clients that never completed OAuth or admin login flows

Monitoring Recommendations

Enable verbose logging on Adobe Commerce API endpoints and forward logs to a centralized SIEM for correlation
Monitor outbound data volumes from Commerce web nodes for anomalous spikes that could indicate bulk data extraction
Track patch state across all Commerce and Magento instances and alert when unpatched versions receive external traffic

How to Mitigate CVE-2026-47997

Immediate Actions Required

Inventory all Adobe Commerce, Commerce B2B, Magento Open Source, and Adobe I/O Events for Commerce deployments and identify versions in scope
Apply the patches referenced in Adobe advisory APSB26-73 to every affected instance, prioritizing internet-facing storefronts
Rotate API keys, integration tokens, and admin credentials on systems that were exposed prior to patching

Patch Information

Adobe addressed CVE-2026-47997 in the security update released on July 14, 2026. Administrators should apply the fixed patch levels documented in the Adobe Security Advisory APSB26-73 for Commerce 2.4.4 through 2.4.9, Commerce B2B 1.3.3 through 1.5.3, corresponding Magento Open Source releases, and the Adobe I/O Events module for Commerce.

Workarounds

Restrict access to Commerce administrative and API endpoints using IP allow-lists at the web tier or WAF
Enforce authentication at an upstream reverse proxy for sensitive REST and GraphQL routes when immediate patching is not possible
Disable unused modules, including Adobe I/O Events, on instances that do not require them until patches are applied

bash

# Example nginx snippet to restrict Commerce REST API to trusted networks
location ~ ^/rest/ {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass http://commerce_backend;
}