CVE-2026-47992 describes an SQL Injection vulnerability (CWE-89) in Adobe Commerce. The flaw involves improper neutralization of special elements used in SQL commands, enabling a high-privileged attacker to execute malicious SQL statements. Exploitation does not require user interaction and may result in arbitrary code execution within the context of the current user, potentially leading to elevated privileges or control over victim accounts or sessions. The CVSS v3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). No official remediation or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows a high-privileged attacker to execute arbitrary SQL commands, which can lead to arbitrary code execution in the context of the current user. This may result in elevated access or control over victim accounts or sessions, compromising confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, monitoring Adobe's security advisories for updates is recommended. No specific mitigations are provided at this time.