CVE-2026-34685

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

• CWE-20

• https://helpx.adobe.com/security/products/magento/apsb26-49.htmlVendor Advisory

Published

May 12, 2026

Last Modified

Jul 14, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3468A stored Cross-Site Scripting (XSS) vulnerability has been i…4.8
• CVE-2026-34680CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.…6.2
• CVE-2026-34681Substance3D - Designer versions 15.1.0 and earlier are affec…7.8
• CVE-2026-34682Substance3D - Designer versions 15.1.0 and earlier are affec…7.8
• CVE-2026-34683Substance3D - Designer versions 15.1.0 and earlier are affec…7.8
• CVE-2026-34684Substance3D - Designer versions 15.1.0 and earlier are affec…7.8
• CVE-2026-34686Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4…8.7
• CVE-2026-34687Illustrator versions 29.8.6, 30.3 and earlier are affected b…7.8
• CVE-2026-34688CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.…6.2
• CVE-2026-3469A denial-of-service (DoS) vulnerability exists due to improp…2.7
• CVE-2026-34690After Effects is affected by a Stack-based Buffer Overflow v…7.8
• CVE-2026-34691Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.…9.3