CVE-2025-27189

CVE-2025-27189 is a medium-severity vulnerability in Adobe Commerce B2b with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-352.

Key facts

Description

Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could be exploited to cause a denial-of-service condition. An attacker could trick a logged-in user into submitting a forged request to the vulnerable application, which may disrupt service availability. Exploitation of this issue requires user interaction, typically in the form of clicking a malicious link or visiting an attacker-controlled website.

Frequently asked questions

What is CVE-2025-27189?
Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could be exploited to cause a denial-of-service condition. An attacker could trick a logged-in user into submitting a forged request to the vulnerable application, which may disrupt service availability. Exploitation of this issue requires user interaction, typically in the form of clicking a malicious link or visiting an attacker-controlled website.
How severe is CVE-2025-27189?
CVE-2025-27189 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2025-27189 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (57th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-27189?
CVE-2025-27189 primarily affects Adobe Commerce B2b. In total, 20 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2025-27189?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-27189 have an EU (EUVD) identifier?
Yes. CVE-2025-27189 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-14842.
When was CVE-2025-27189 published?
CVE-2025-27189 was published on 2025-04-08 and last updated on 2026-06-17.

References

Affected products (20)

More vulnerabilities in Adobe Commerce B2b

All CVEs affecting Adobe Commerce B2b →

Other CWE-352 (Cross-Site Request Forgery (CSRF)) vulnerabilities

Browse all CWE-352 (Cross-Site Request Forgery (CSRF)) vulnerabilities →