CVE-2026-47992

Analyzed Analyzed - Analysis Complete

Improper SQL Injection in Adobe Commerce

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: Adobe Systems Incorporated

Description

Adobe Commerce is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could exploit this vulnerability to execute malicious SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-47992

EUVD

EUVD-2026-44412

Affected Vendors & Products

Vendor	Product	Version / Range
adobe	commerce	2.4.4
adobe	commerce	2.4.5
adobe	commerce	2.4.4
adobe	commerce	2.4.5
adobe	commerce	2.4.4
adobe	commerce	2.4.5
adobe	commerce	2.4.4
adobe	commerce	2.4.6
adobe	commerce	2.4.4
adobe	commerce	2.4.5
adobe	commerce	2.4.6
adobe	commerce	2.4.5
adobe	commerce	2.4.4
adobe	commerce	2.4.7
adobe	commerce	2.4.5
adobe	commerce	2.4.6
adobe	commerce	2.4.6
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.7
adobe	commerce	2.4.7
adobe	commerce	2.4.7
adobe	commerce	2.4.6
adobe	commerce	2.4.6
adobe	commerce	2.4.6
adobe	commerce	2.4.5
adobe	commerce	2.4.5
adobe	commerce	2.4.5
adobe	commerce	2.4.7
adobe	commerce	2.4.4
adobe	commerce	2.4.5
adobe	commerce	2.4.6
adobe	commerce	2.4.7
adobe	commerce	2.4.4
adobe	commerce	2.4.8
adobe	commerce	2.4.7
adobe	commerce	2.4.6
adobe	commerce	2.4.5
adobe	commerce	2.4.4
adobe	commerce	2.4.5
adobe	commerce	2.4.6
adobe	commerce	2.4.7
adobe	commerce	2.4.8
adobe	commerce	2.4.7
adobe	commerce	2.4.8
adobe	commerce	2.4.4
adobe	commerce	2.4.5
adobe	commerce	2.4.6
adobe	commerce	2.4.4
adobe	commerce	2.4.5
adobe	commerce	2.4.6
adobe	commerce	2.4.7
adobe	commerce	2.4.8
adobe	commerce	2.4.9
adobe	commerce	2.4.4
adobe	commerce	2.4.5
adobe	commerce	2.4.6
adobe	commerce	2.4.7
adobe	commerce	2.4.8
adobe	commerce	2.4.4
adobe	commerce	2.4.5
adobe	commerce	2.4.6
adobe	commerce	2.4.7
adobe	commerce	2.4.8
adobe	commerce	2.4.8
adobe	commerce	2.4.7
adobe	commerce	2.4.6
adobe	commerce	2.4.6
adobe	commerce	2.4.5
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.5
adobe	commerce	2.4.7
adobe	commerce	2.4.8
adobe	commerce_b2b	1.4.2
adobe	commerce_b2b	1.4.2
adobe	commerce_b2b	1.4.2
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.4.2
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.4.2
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.4.2
adobe	commerce_b2b	1.5.2
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.4.2
adobe	commerce_b2b	1.5.2
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.4.2
adobe	commerce_b2b	1.5.2
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.4.2
adobe	commerce_b2b	1.5.2
adobe	commerce_b2b	1.5.2
adobe	commerce_b2b	1.4.2
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.4.2
adobe	commerce_b2b	1.5.2
adobe	commerce_b2b	1.5.3
adobe	magento	2.4.6
adobe	magento	2.4.6
adobe	magento	2.4.6
adobe	magento	2.4.7
adobe	magento	2.4.6
adobe	magento	2.4.6
adobe	magento	2.4.6
adobe	magento	2.4.7
adobe	magento	2.4.7
adobe	magento	2.4.7
adobe	magento	2.4.6
adobe	magento	2.4.7
adobe	magento	2.4.6
adobe	magento	2.4.7
adobe	magento	2.4.8
adobe	magento	2.4.7
adobe	magento	2.4.6
adobe	magento	2.4.6
adobe	magento	2.4.7
adobe	magento	2.4.8
adobe	magento	2.4.6
adobe	magento	2.4.7
adobe	magento	2.4.8
adobe	magento	2.4.6
adobe	magento	2.4.7
adobe	magento	2.4.8
adobe	magento	2.4.6
adobe	magento	2.4.7
adobe	magento	2.4.8
adobe	magento	2.4.6
adobe	magento	2.4.7
adobe	magento	2.4.8
adobe	magento	2.4.6
adobe	magento	2.4.7
adobe	magento	2.4.8
adobe	magento	2.4.6
adobe	magento	2.4.7
adobe	magento	2.4.8
adobe	magento	2.4.9
adobe	i/o_events	From 1.6.0 (inc) to 1.21.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-89	The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CWE ID

Description

CWE-89

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

Executive Summary

Adobe Commerce has an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This allows a high-privileged attacker to execute malicious SQL commands, potentially gaining elevated access or control over the victim's account or session without requiring user interaction.

Impact Analysis

This vulnerability could allow attackers to execute arbitrary code, steal sensitive data, modify or delete database records, or take full control of the affected system. Attackers might gain access to user accounts, payment information, or other confidential data.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties, fines, or reputational damage due to unauthorized access to personal or health data.

Mitigation Strategies

Apply the latest security patches or updates from Adobe Commerce immediately to address the SQL injection vulnerability. Ensure all user accounts follow the principle of least privilege to limit potential damage from exploitation.

Hi! I’m here to help you understand CVE-2026-47992. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

Improper SQL Injection in Adobe Commerce

Description

CVSS Scores

EPSS Scores

Meta Information

Affected Vendors & Products

Helpful Resources

Exploitability

Attack-Flow Graph

AI Quick Actions

Chat Assistant

EPSS Chart