CVE-2025-27189 Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)

Medium 4.3 Published 8 Apr 2025 Updated 8 Apr 2025

Attackers can trick logged-in users into submitting forged requests, causing a denial-of-service condition in Adobe Commerce.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-27189?

CVE-2025-27189 is a medium-severity vulnerability in Adobe Commerce B2b, published on 8 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could be exploited to cause a denial-of-service condition. An attacker could trick a logged-in user into submitting a forged request to the vulnerable application, which may disrupt service availability. Exploitation of this issue requires user interaction, typically in the form of clicking a malicious link or visiting an attacker-controlled website.

Weakness: CWE-352

Which versions are affected by CVE-2025-27189?

It affects 1 product.

Products include Adobe Commerce B2b.

How do I fix CVE-2025-27189?

No fix has been published for CVE-2025-27189 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-27189 being exploited?

There is no known exploitation of CVE-2025-27189 in the wild and no public exploit code.

All Adobe Commerce B2b vulnerabilities

Sources

Also known as GHSA-fpf8-39f6-cgrc.