CVE-2025-54263

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. A low-privileged attacker could leverage this vulnerability to bypass security measures and maintain unauthorized access. Exploitation of this issue does not require user interaction.

CVSS 3.1

8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS

0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-25)

CWE

CWE-863

Published

2025-10-14

Modified

2026-10-08

Record from

the NVD, synced 2026-10-19

Affected

• adobe:commerce
• adobe:commerce_b2b
• adobe:magento

References

• https://helpx.adobe.com/security/products/magento/apsb25-94.html

Check your stackJSON