CVSS 9.3 (CRITICAL) · Actively exploited (listed in CISA KEV)
Adobe Commerce contains an unrestricted file upload vulnerability allowing arbitrary code execution. Exploitation requires user interaction with a malicious URL or compromised page.
Attackers can gain elevated access or control over the victim's account or session. This poses a severe risk to data integrity and user privacy.
Apply vendor mitigations immediately and ensure compliance with CISA BOD 26-04. Evaluate internet exposure and discontinue use if mitigations are unavailable.
Adobe Commerce 存在不受限制的檔案上傳漏洞，可能導致任意程式碼執行。攻擊者需誘導使用者造訪惡意網址或與受感染的網頁互動才能利用此漏洞。
立即套用廠商提供的緩解措施，並遵循 CISA BOD 26-04 指南。評估資產的網際網路暴露情況，若無法緩解則停止使用該產品。