CVE-2025-24434 is a critical Incorrect Authorization vulnerability affecting multiple versions of Adobe Commerce, including 2.4.8-beta1 and earlier. This flaw allows an unauthenticated attacker to bypass security measures and achieve privilege escalation, potentially leading to session takeover with high impact on confidentiality and integrity. With a CVSS score of 9.1, this vulnerability is easily exploitable over the network without user interaction. While there is no current evidence of active exploitation or public exploit code, and community discussion is minimal, its critical severity warrants immediate attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.4.4CPE matchmatch criteria | cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:* | ||
2.4.4CPE matchmatch criteria | cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:* | ||
2.4.4CPE matchmatch criteria | cpe:2.3:a:adobe:commerce:2.4.4:p10:*:*:*:*:*:* | ||
2.4.4CPE matchmatch criteria | cpe:2.3:a:adobe:commerce:2.4.4:p11:*:*:*:*:*:* | ||
2.4.4CPE matchmatch criteria | cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.