CVE-2026-34647 is an SSRF vulnerability in Adobe Commerce affecting versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17, and earlier. This vulnerability enables an attacker to bypass security controls and gain unauthorized read access by leveraging server-side request forgery. Exploitation requires user interaction, such as visiting a maliciously crafted URL or interacting with a compromised web page. The vulnerability changes the security scope and has a CVSS 3.1 base score of 7.4 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N). No vendor-provided patch or official remediation is currently documented.

Successful exploitation can lead to unauthorized read access by bypassing security features in affected Adobe Commerce versions. The vulnerability does not impact integrity or availability but compromises confidentiality. User interaction is required for exploitation, which limits the attack vector to scenarios involving social engineering or malicious content delivery. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted URLs and avoid interacting with suspicious web content. Monitor Adobe's security advisories for updates on patches or mitigations.