CVE-2026-95630: Improper Input Validation (CWE-20) in Adobe Adobe Commerce

Adobe Commerce suffers from an improper input validation vulnerability (CWE-20) that could enable a low-privileged attacker to bypass security controls and obtain unauthorized read access. Exploitation does not require user interaction. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality impact. No official patch or vendor advisory details are available at this time.

An attacker with low privileges can exploit this vulnerability to bypass security features and gain unauthorized read access to data. There is no impact on integrity or availability. Exploitation does not require user interaction, increasing the risk of automated or remote attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, monitor for updates from Adobe and apply patches promptly once available.