Adobe Commerce and Magento improper input validation allows high-privilege attackers to execute arbitrary code (CVE-2026-95631)

What happened

Adobe Commerce, Adobe Commerce B2B and Magento Open Source are affected by an improper input validation vulnerability tracked as CVE-2026-95631. The CVE record states that an attacker with high privileges could exploit this to execute arbitrary code in the context of the current user. Exploitation does not require user interaction, and the scope is changed.

The CVSS 3.1 score is 8.7, rated high. The attack vector is network-based, attack complexity is low, high privileges are required, and no user interaction is needed. The impact is high for integrity and availability, with no confidentiality impact. The CVE record does not record exploitation; CISA KEV does not list this issue, and public disclosure has not been recorded.

Who is affected

Affected versions are the September 2026 builds up to and including:

• Adobe Commerce: 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep
• Adobe Commerce B2B: 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep
• Magento Open Source: 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep

These products typically run public storefronts and back-office systems. If you operate Adobe Commerce or Magento on one of these builds, you are affected.

What to do now

1. Apply Adobe's fixed builds. The versions listed as fixed are:

• Adobe Commerce: 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-oct
• Adobe Commerce B2B: 1.5.4-alpha1, 1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, 1.3.3-2026-oct
• Magento Open Source: 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct

1. The CVE record does not list a workaround. Treat applying the fixed build as the primary control.
2. If you cannot patch immediately, restrict access to the Commerce admin and review high-privilege accounts. Exploitation requires high privileges, so reducing the number and standing of privileged users lowers immediate exposure.

How to detect it

Adobe has not published indicators of compromise for this CVE. Because exploitation requires high privileges, focus on administrative and integration accounts that modify code, deploy packages, or change server configuration. Compare recent changes with your deployment pipeline; unexpected actions by a privileged account are the main thing to review.

No public exploitation or disclosure has been recorded, so routine monitoring should be proportionate.

Beyond the patch

A Commerce compromise is not just a website issue; it is a customer-facing business system with order and administrative access behind it. A penetration test and hardening review from Implementation & Assessment Services can confirm the paths available to a privileged user, and Managed Detection & Response can detect post-exploitation activity in SIEM and EDR before it becomes a wider incident.