CVE-2025-49555: Adobe Commerce · Cross-Site Request Forgery (CSRF)
Affects Adobe CommerceSource CVE Database V5
Not known to be exploited · CVSS 8.1 High.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 0.8% chance of exploitation in 30 days – higher than 58% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:NExploitation evidence
Disclosed: evidence found.
CVE published 12 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Adobe Adobe Commerce | Affected
| Fixed in– |
AI-suggested
Organizations should implement the following specific mitigations: 1) Monitor Adobe's official channels for patches addressing CVE-2025-49555 and apply them immediately upon release. 2) Enforce strict anti-CSRF protections such as synchronizer tokens or double-submit cookies in the Adobe Commerce environment to validate legitimate requests. 3) Limit the use of high-privileged accounts and enforce the principle of least privilege to reduce the attack surface. 4) Educate users, especially administrators, about the risks of clicking unknown links or visiting untrusted websites while authenticated. 5) Employ web application firewalls (WAFs) with rules designed to detect and block CSRF attack patterns. 6) Regularly audit and monitor logs for unusual or unauthorized actions that could indicate exploitation attempts. 7) Consider implementing multi-factor authentication (MFA) to add an additional layer of security for privileged accounts. These measures, combined with timely patching, will significantly reduce the risk posed by this vulnerability.
Description
Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in privilege escalation. A high-privileged attacker could trick a victim into executing unintended actions on a web application where the victim is authenticated, potentially allowing unauthorized access or modification of sensitive data. Exploitation of this issue requires user interaction in that a victim must visit a malicious website or click on a crafted link. Scope is changed.