CVE-2025-27206

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited write access. Exploitation of this issue does not require user interaction.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Adobe	Adobe Commerce	<= 2.4.4-p13

References

https://helpx.adobe.com/security/products/magento/apsb25-50.htmlVendor Advisory

Timeline

Published: Jun 10, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-272076.5Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerabilit CVE-2025-272086.1A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2. An attacker could trick a user wi CVE-2025-272097.5The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the Has CVE-2025-272107.5An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. CVE-2025-272117.5An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.10.4 and earlier) could allow a Command Injection by a malicious actor with ac CVE-2025-272129.8An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Acces CVE-2025-272134.9An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect devices to enable Android Debug B CVE-2025-272149.8A Missing Authentication for Critical Function vulnerability in the UniFi Connect EV Station Pro may allow a malicious actor with physical o CVE-2025-272158.1An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect Display Cast devices to make unsu CVE-2025-272168.8Multiple Incorrect Permission Assignment for Critical Resource in UISP Application may allow a malicious actor with certain permissions to e CVE-2025-272179.1A Server-Side Request Forgery (SSRF) in the UISP Application may allow a malicious actor with certain permissions to make requests outside o CVE-2025-272185.3Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserializa