cbcvebase.
CVE-2026-77110
published 2026-09-08

CVE-2026-77110: Adobe Commerce is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security…

PriorityP347high7.6CVSS 3.1
AVNACLPRHUINSCCNIHAL
EPSS
0.72%
51.9th percentile
Adobe Commerce is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to access unauthorized files or directories outside the intended restrictions, causing a limited disruption to availability. Exploitation of this issue does not require user interaction. Scope is changed.

Affected

160 ranges· showing 25
VendorProductVersion rangeFixed in
adobeadobe_commerce<= 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug—
adobeadobe_commerce_b2b<= 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug—
adobecommerce< 2.4.42.4.4
adobecommerce——
adobecommerce——
adobecommerce——
adobecommerce——
adobecommerce——
adobecommerce——
adobecommerce——
adobecommerce——
adobecommerce——
adobecommerce——
adobecommerce——
adobecommerce——
adobecommerce——
adobecommerce——
adobecommerce——
adobecommerce——
adobecommerce——
adobecommerce——
adobecommerce——
adobecommerce——
adobecommerce——
adobecommerce——
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.