CVE-2026-47992

CVE-2026-47992 is a SQL injection in Adobe Commerce with a CVSS of 7.2, but the 'high-privileged attacker' requirement fundamentally changes how you should prioritize and model this vulnerability. This is not an initial access vector—it requires an attacker who already holds elevated privileges within Adobe Commerce. The question you must answer for your environment is: what specific privilege threshold triggers this? Admin role? API service account? That distinction determines whether this is a meaningful escalation path or merely a way to expand within permissions an attacker already has. The 'arbitrary code execution' framing deserves skepticism. SQL injection in a PHP/MySQL stack doesn't automatically yield code execution—it typically requires stacked queries or INTO OUTFILE, neither guaranteed in Adobe's default or hardened configurations. If your database user lacks file privileges and MySQL root access is restricted, this may behave more like a 5.0 in practice than the 7.2 headline suggests. Validate your database privilege configuration before calibrating urgency solely on CVSS. The EPSS percentile of 0.19924 (80th) is the wrong metric for post-authentication vulnerabilities. EPSS measures generic exploitation probability for external scanners and anonymous attackers—it doesn't weight impact given exploitation. If an attacker already has admin credentials, exploitation probability approaches 1, not 0.20. For vulnerabilities requiring admin access, compare the exploitation baseline to phishing click-through rates and credential stuffing success against admin portals rather than to anonymous SQL injection. Critically, the privilege gate concentrates blast radius rather than fragmenting it. An admin account in Adobe Commerce already has access to customer PII, payment gateway configurations, API keys, and persistent session tokens. The attacker doesn't need to pivot—they're already at the hub. Threat actors specifically target post-auth access paths in e-commerce platforms because monetization is immediate. Prioritize your response: first, determine the exact privilege threshold required to exploit this SQL injection—if it's a narrow service account rather than full admin, patch immediately and treat it as a genuine escalation vector. Second, audit your database user privileges and restrict FILE privileges if enabled. Third, use this CVE as a trigger to audit authenticated code paths in Adobe Commerce for similar injection patterns; privilege-gated SQL injection often clusters around specific modules that have been flagged before, suggesting the underlying data access abstraction may carry the same risk across your installation.

Reviewed through automated stages and approved by a human before publication.