Magento vulnerabilities

95 known vulnerabilities in Magento from Adobe. 95 are rated high or critical, and 6 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.0 High severity

  Adobe Commerce: Improper Neutralization of Input During Web Page Generation

  CVE-2026-21311Mar 11, 2026Adobe

  Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerab

• 7.5 High severity

  Adobe Commerce: Incorrect Authorization

  CVE-2026-21309Mar 11, 2026Adobe

  Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypa

• 8.7 High severity

  Adobe Commerce: Improper Neutralization of Input During Web Page Generation

  CVE-2026-21290Mar 11, 2026Adobe

  Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerabl

• 7.5 High severity

  Adobe Commerce: Incorrect Authorization

  CVE-2026-21289Mar 11, 2026Adobe

  Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypa

• 8.1 High severity

  Adobe Commerce: Improper Neutralization of Input During Web Page Generation

  CVE-2026-21284Mar 11, 2026Adobe

  Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerab

• 8.1 High severity

  Adobe Commerce: Improper Neutralization of Input During Web Page Generation

  CVE-2025-54264Oct 14, 2025Adobe

  Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by a stored Cross-Site Scripting (XSS) Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject mali

• 8.1 High severity

  Adobe Commerce: Incorrect Authorization

  CVE-2025-54263Oct 14, 2025Adobe

  Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. A low-privileged attacker could leverage this vulnerability to bypass security measures and maintain

• 9.1 Critical severity

  Adobe Commerce and Magento Improper Input Validation Exploited

  CVE-2025-54236Sep 9, 2025AdobeEPSS 95.5%

  Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality,

• 8.7 High severity

  Adobe Commerce: Improper Neutralization of Input During Web Page Generation

  CVE-2025-49557Aug 12, 2025Adobe

  Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulner

• 7.5 High severity

  Adobe Commerce: Incorrect Authorization

  CVE-2025-49556Aug 12, 2025Adobe

  Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to bypa

• 8.1 High severity

  Adobe Commerce: Cross-Site Request Forgery

  CVE-2025-49555Aug 12, 2025Adobe

  Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in privilege escalation. A high-privileged attacker could trick a victim i

• 7.5 High severity

  Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and…

  CVE-2025-49554Aug 12, 2025Adobe

  Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Input Validation vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability by p

• 8.4 High severity

  Adobe Commerce: Improper Neutralization of Input During Web Page Generation

  CVE-2025-47110Jun 10, 2025Adobe

  Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. M

• 8.1 High severity

  Adobe Commerce: Improper Access Control

  CVE-2025-43586Jun 10, 2025Adobe

  Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result in privilege escalation. A low privileged attacker could leverage this vulnerability to bypass secur

• 8.2 High severity

  Adobe Commerce: Improper Authorization

  CVE-2025-43585Jun 10, 2025Adobe

  Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measur

• 8.7 High severity

  Adobe Commerce: Improper Neutralization of Input During Web Page Generation

  CVE-2025-24438Feb 11, 2025Adobe

  Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form field

• 9.1 Critical severity

  Adobe Commerce: Incorrect Authorization

  CVE-2025-24434Feb 11, 2025AdobeEPSS 17.2%

  Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to bypass security measu

• 8.7 High severity

  Adobe Commerce: Improper Neutralization of Input During Web Page Generation

  CVE-2025-24417Feb 11, 2025Adobe

  Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form field

• 8.7 High severity

  Adobe Commerce: Improper Neutralization of Input During Web Page Generation

  CVE-2025-24416Feb 11, 2025Adobe

  Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form field

• 8.7 High severity

  Adobe Commerce: Improper Neutralization of Input During Web Page Generation

  CVE-2025-24415Feb 11, 2025Adobe

  Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form field

• 8.7 High severity

  Adobe Commerce: Improper Neutralization of Input During Web Page Generation

  CVE-2025-24414Feb 11, 2025Adobe

  Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form field

• 8.7 High severity

  Adobe Commerce: Improper Neutralization of Input During Web Page Generation

  CVE-2025-24413Feb 11, 2025Adobe

  Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form field

• 8.7 High severity

  Adobe Commerce: Improper Neutralization of Input During Web Page Generation

  CVE-2025-24412Feb 11, 2025Adobe

  Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form field

• 8.1 High severity

  Adobe Commerce: Improper Access Control

  CVE-2025-24411Feb 11, 2025Adobe

  Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to by

• 8.7 High severity

  Adobe Commerce: Improper Neutralization of Input During Web Page Generation

  CVE-2025-24410Feb 11, 2025Adobe

  Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form field

• 8.2 High severity

  Adobe Commerce: Incorrect Authorization

  CVE-2025-24409Feb 11, 2025Adobe

  Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security

• 7.5 High severity

  Adobe Commerce: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2025-24406Feb 11, 2025AdobeEPSS 1.4%

  Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to a security feature bypass. An unauthent

• 7.7 High severity

  Adobe Commerce: Server-Side Request Forgery

  CVE-2024-49521Nov 12, 2024Adobe

  Adobe Commerce versions 3.2.5 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to a security feature bypass. A low privileged attacker could exploit this vulnerability to send crafted requests from the vulnerable s

• 8.8 High severity

  Adobe Commerce: Improper Authentication

  CVE-2024-45148Oct 10, 2024Adobe

  Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to gain unauthorize

• 7.6 High severity

  Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an…

  CVE-2024-45117Oct 10, 2024Adobe

  Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An admin attacker could exploit this vulnerability to read files from the syst

• 8.1 High severity

  Adobe Commerce: Improper Neutralization of Input During Web Page Generation

  CVE-2024-45116Oct 10, 2024Adobe

  Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Cross-Site Scripting (XSS) vulnerability that could be exploited to execute arbitrary code. If an admin attacker can trick a user into clicking a specially crafted li

• 9.8 Critical severity

  Adobe Commerce: Improper Authentication

  CVE-2024-45115Oct 10, 2024AdobeEPSS 1.25%

  Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated

• 7.6 High severity

  Adobe Commerce: Improper Neutralization of Input During Web Page Generation

  CVE-2024-39403Aug 14, 2024Adobe

  Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious Ja

• 8.4 High severity

  Adobe Commerce: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-39402Aug 14, 2024AdobeEPSS 1.67%

  Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attac

• 8.4 High severity

  Adobe Commerce: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-39401Aug 14, 2024AdobeEPSS 1.67%

  Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attac

• 8.1 High severity

  Adobe Commerce: Improper Neutralization of Input During Web Page Generation

  CVE-2024-39400Aug 14, 2024Adobe

  Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context

• 7.7 High severity

  Adobe Commerce: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2024-39399Aug 14, 2024Adobe

  Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. A low-privileged attacker

• 7.4 High severity

  Adobe Commerce: Improper Restriction of Excessive Authentication Attempts

  CVE-2024-39398Aug 14, 2024Adobe

  Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability t

• 9.0 Critical severity

  Adobe Commerce: Unrestricted Upload of File with Dangerous Type

  CVE-2024-39397Aug 14, 2024AdobeEPSS 1.1%

  Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution by an attacker. An attacker could exploit this vulnerabili

• 8.8 High severity

  Adobe Commerce: Server-Side Request Forgery

  CVE-2024-34111Jun 13, 2024AdobeEPSS 1.27%

  Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make a