CVE-2025-49554

Adobe Commerce | Improper Input Validation (CWE-20)

State: Published
Severity: 7.5 High
Published: Aug 12, 2025
Updated: Aug 13, 2025
Reserved: Jun 6, 2025

Description

Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Input Validation vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability by providing specially crafted input, causing the application to crash or become unresponsive. Exploitation of this issue does not require user interaction.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	adobe

Weaknesses

CWE-20 Improper Input Validation (CWE-20)

Affected Products

Product	Versions
Adobe CommerceAdobe	2.4.4-p14 and earlierAffected

References

https://helpx.adobe.com/security/products/magento/apsb25-71.htmlvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.