CVE-2026-47996

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could lead to arbitrary file system read. A high-privileged attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.

• CWE-863

• https://helpx.adobe.com/security/products/magento/apsb26-73.htmlVendor Advisory

Published

Jul 14, 2026

Last Modified

Aug 5, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47990Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 a…5.4
• CVE-2026-47991Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 a…6.1
• CVE-2026-47992Adobe Commerce is affected by an Improper Neutralization of …7.2
• CVE-2026-47993Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 a…5.4
• CVE-2026-47994Adobe Commerce is affected by a stored Cross-Site Scripting …8.7
• CVE-2026-47995Adobe Commerce is affected by a stored Cross-Site Scripting …8.1
• CVE-2026-47997Adobe Commerce is affected by an Incorrect Authorization vul…5.9
• CVE-2026-47998Adobe Commerce is affected by an Incorrect Authorization vul…5.9
• CVE-2026-47999Adobe Commerce is affected by a stored Cross-Site Scripting …4.8
• CVE-2026-4800Impact: The fix for CVE-2021-23337 (https://github.com/advi…9.8
• CVE-2026-48000Adobe Commerce is affected by an Improper Redirect (Open Red…6.1
• CVE-2026-48001Adobe Commerce is affected by an Information Exposure vulner…3.7