CVE-2026-95631: Adobe Commerce | Improper Input Validation (CWE-20)
Published Oct 13, 2026
·Updated
Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Affected Software
1 affected component
Adobe Adobe Commerce
Event History
Oct 13, 2026
CVE Published
via MITRE·06:15 PM
Data Sourced
via MITRE·06:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this vulnerability?
An attacker must already have high privileges in Adobe Commerce. The vulnerability is remotely reachable and does not require user interaction.
2
What is the potential impact of successful exploitation?
A successful attacker could execute arbitrary code in the context of the current user. The reported impact includes integrity and availability consequences, and the vulnerability has changed scope.
3
Is user interaction required for exploitation?
No. Exploitation does not require any action from another user.