CVE-2024-34104highCWE-285

CVE-2024-34104: high-severity vulnerability in Adobe Commerce

Adobe Commerce | Improper Authorization (CWE-285)

Published · Updated

Follow this CVE+ Monitor Adobe Commerce+ Monitor magento/community-edition

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 0.8%
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access, leading to both confidentiality and integrity impact. Exploitation of this issue does not require user interaction.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Affected products
Adobe · Adobe Commerce
Related CVEs — Adobe Commerce

In the same product, most dangerous first.

CVE-2024-34102CRITICALXXE can expose crypt key and other secrets granting full admin accessEPSS 100.0%KEVCVE-2026-75650CRITICALAdobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)EPSS 99.4%KEVCVE-2025-54236CRITICALAdobe Commerce | Improper Input Validation (CWE-20)EPSS 95.4%KEVCVE-2026-71362CRITICALAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 90.5%KEVCVE-2026-48356CRITICALAdobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)EPSS 47.5%CVE-2026-34648HIGHAdobe Commerce | Uncontrolled Resource Consumption (CWE-400)EPSS 21.4%