CVE-2025-27192: Adobe Commerce | Insufficiently Protected Credentials (CWE-522)
Description
Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could lead to a security feature bypass. A high privileged attacker could exploit this vulnerability to gain unauthorized access to protected resources by obtaining sensitive credential information. Exploitation of this issue does not require user interaction.
Classification
CVE ID: CVE-2025-27192
CVSS Base Severity: LOW
CVSS Base Score: 2.7
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Problem Types
Insufficiently Protected Credentials (CWE-522)Affected Products
Vendor: Adobe
Product: Adobe Commerce
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.09% (probability of being exploited)
EPSS Percentile: 26.79% (scored less or equal to compared to others)
EPSS Date: 2025-04-18 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-27192https://helpx.adobe.com/security/products/magento/apsb25-26.html