CVE-2026-34654 describes a medium severity vulnerability in Adobe Commerce caused by reliance on a vulnerable third-party component (CWE-1395). This flaw can be exploited remotely without authentication or user interaction to crash the application, resulting in denial-of-service. Affected versions include 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17, and earlier. The vulnerability impacts application availability but does not affect confidentiality or integrity. No vendor advisory or patch information is currently available, and no exploits have been reported in the wild.

Successful exploitation leads to application denial-of-service, disrupting availability of Adobe Commerce instances. There is no impact on confidentiality or integrity. The vulnerability can be exploited remotely without privileges or user interaction, increasing the risk of disruption. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor Adobe's security advisories for updates. Consider limiting exposure of affected Adobe Commerce instances to untrusted networks to reduce risk of exploitation.