CVE-2026-92464: Improper Input Validation (CWE-20) in Adobe Adobe Commerce

Adobe Commerce suffers from an improper input validation vulnerability (CWE-20) that enables an attacker possessing high privileges to execute arbitrary code in the context of the current user. The vulnerability does not require user interaction and changes the security scope, potentially allowing full system compromise. The CVSS v3.1 score is 9.1, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability.

An attacker with high privileges can exploit this vulnerability remotely without user interaction to execute arbitrary code, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The change in scope indicates that the vulnerability may allow privilege escalation or affect resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, limit high-privilege access to Adobe Commerce and monitor for unusual activity related to code execution.