CVE-2026-95631: Improper Input Validation (CWE-20) in Adobe Adobe Commerce

Adobe Commerce contains an improper input validation vulnerability (CWE-20) that could be exploited by an attacker with high privileges to execute arbitrary code in the context of the current user. The vulnerability does not require user interaction and changes the security scope, potentially allowing elevated impact. The CVSS 3.1 score is 8.7 (high severity) with vector AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H, indicating network attack vector, low attack complexity, high privileges required, no user interaction, changed scope, no confidentiality impact, but high integrity and availability impact.

An attacker with high privileges can exploit this vulnerability remotely without user interaction to execute arbitrary code, potentially leading to full compromise of the affected system's integrity and availability. The scope change indicates that the vulnerability may allow privilege escalation or affect resources beyond the initially vulnerable component.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. Until a fix is available, restrict high privilege access and monitor for suspicious activity related to Adobe Commerce.