CVE-2026-47992: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) in Adobe Adobe Commerce

CVE-2026-47992 is an SQL Injection vulnerability in Adobe Commerce caused by improper neutralization of special elements in SQL commands. A high-privileged attacker can exploit this flaw to execute malicious SQL commands, potentially leading to arbitrary code execution and elevated privileges within the affected system. Exploitation does not require user interaction. The vulnerability is rated high severity with a CVSS 3.1 base score of 7.2. No official remediation or patch information is currently available, and no affected versions have been explicitly identified.

Successful exploitation allows a high-privileged attacker to execute arbitrary SQL commands, which can lead to arbitrary code execution in the context of the current user. This may result in elevated access or control over the victim's account or session, compromising confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, monitor Adobe's security advisories for updates. Until a patch is available, restrict high-privileged user access and review application configurations to minimize exposure.