Vulnerability Description
Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability by manipulating the timing between the check of a resource's state and its use, allowing unauthorized write access. Exploitation of this issue does not require user interaction.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Adobe | Commerce | < 2.4.4 |
| Adobe | Commerce B2B | < 1.3.3 |
| Adobe | Magento | < 2.4.5 |
Related Weaknesses (CWE)
References
FAQ
What is CVE-2025-49558?
CVE-2025-49558 is a vulnerability with a CVSS score of 5.9 (MEDIUM). Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could resul...
How severe is CVE-2025-49558?
CVE-2025-49558 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-49558?
Check the references section above for vendor advisories and patch information. Affected products include: Adobe Commerce, Adobe Commerce B2B, Adobe Magento.