{"id":"CVE-2026-92464","published":"2026-10-13T19:21:43.370","lastModified":"2026-10-15T11:18:04.260","description":"Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-20"],"vendors":[],"products":[],"references":[{"url":"https://www.adobe.com/trust/security/products/commerce/apsb26-153.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Adobe Commerce is vulnerable to an improper input validation flaw that allows attackers with high privileges to execute arbitrary code as the current user. This represents a critical privilege escalation vulnerability where a malicious actor can gain full control over the application's execution environment.","exploitability":"Exploitation requires high-privilege access but is relatively straightforward once achieved, as it doesn't require user interaction and allows for arbitrary code execution in the application context.","blast_radius":"If exploited, this vulnerability could allow attackers to execute malicious code with the privileges of the Adobe Commerce application, potentially leading to complete system compromise through further lateral movement or data exfiltration.","remediation":"Upgrade to Adobe Commerce 2.590 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","privilege-escalation","web","commerce"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:56:46.175Z"}}