Loading vulnerability…
Incorrect Authorization in Adobe Commerce
CVE-2026-47984 is an incorrect authorization vulnerability in Adobe Commerce and related offerings including Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin. The flaw allows security controls to be bypassed, resulting in unauthorized read and write access. The available information identifies the issue as a security feature bypass caused by improper authorization enforcement, but does not disclose the specific vulnerable function or code path. Exploitation does not require user interaction.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker to bypass intended security restrictions and obtain unauthorized read and write access within the affected application context. This can enable unauthorized viewing and modification of data and may undermine application-level access controls and other protective mechanisms enforced by the platform.
If you can’t patch tonight, do this now.
No product-specific workaround is described in the available vulnerability information. Where immediate patching is not possible, reduce exposure by enforcing least privilege, restricting access to administrative and sensitive application functions, monitoring for unauthorized read/write activity, and accelerating deployment of the vendor security updates.
Patch, then assume compromise.
Upgrade affected products to vendor-fixed releases. Reported fixed versions include Adobe Commerce 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, and 2.4.4-2026-jul as applicable; Adobe Commerce B2B 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, and 1.3.3-2026-jul as applicable; Magento Open Source 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, and 2.4.6-2026-jul as applicable; and Adobe Commerce Webhooks Plugin 1.21.0.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.