Adobe Security Bulletin

Last updated on Mar 11, 2026

Security update available for Adobe Commerce | APSB26-05

Bulletin ID

Date published

Priority

APSB26-05

March 10, 2026

2

style

grid width 12

Summary

Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves critical, important, and moderate vulnerabilities. Successful exploitation could lead to security feature bypass, application denial-of-service, privilege escalation, arbitrary code execution, and arbitrary file system read.

Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.

Affected versions

Product

Version

Priority rating

Platform

Adobe Commerce

2.4.9-alpha3 and earlier
2.4.8-p3 and earlier
2.4.7-p8 and earlier
2.4.6-p13 and earlier
2.4.5-p15 and earlier
2.4.4-p16 and earlier

2

All

Adobe Commerce B2B

1.5.3-alpha3 and earlier
1.5.2-p3 and earlier
1.4.2-p8 and earlier
1.3.5-p13 and earlier
1.3.4-p15 and earlier
1.3.3-p16 and earlier

2

All

Magento Open Source

2.4.9-alpha3
2.4.8-p3 and earlier
2.4.7-p8 and earlier
2.4.6-p13 and earlier
2.4.5-p15 and earlier

2

All

style

grid width 12

Solution

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version.

Product

Updated Version

Platform

Priority rating

Installation Instructions

Adobe Commerce

2.4.9-beta1 for 2.4.9-alpha3 / 2.4.8-p4 for 2.4.8-p3 and earlier / 2.4.7-p9 for 2.4.7-p8 and earlier / 2.4.6-p14 for 2.4.6-p13 and earlier / 2.4.5-p16 for 2.4.5-p15 and earlier / 2.4.4-p17 for 2.4.4-p16 and earlier

All

2

2.4.x release notes

Adobe Commerce B2B

1.5.3-beta1 for 1.5.3-alpha3 / 1.5.2-p4 for 1.5.2-p3 and earlier / 1.4.2-p9 for 1.4.2-p8 and earlier / 1.3.5-p14 for 1.3.5-p13 and earlier / 1.3.4-p16 for 1.3.4-p15 and earlier / 1.3.3-p17 for 1.3.3-p16 and earlier

All

2

Magento Open Source

2.4.9-beta1 for 2.4.9-alpha3 / 2.4.8-p4 for 2.4.8-p3 and earlier / 2.4.7-p9 for 2.4.7-p8 and earlier / 2.4.6-p14 for 2.4.6-p13 and earlier / 2.4.5-p16 for 2.4.5-p15 and earlier

All

2

2.4.9-beta1 release notes

style

grid width 12

Vulnerability Details

CVE-2026-21361

Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Critical
Authentication required to exploit? Yes
CVSS base score: 8.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Notes:

CVE-2026-21284

Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Critical
Authentication required to exploit? Yes
CVSS base score: 8.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Notes:

CVE-2026-21289

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Security feature bypass
Severity: Critical
Authentication required to exploit? Yes
CVSS base score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Notes:

CVE-2026-21290

Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Critical
Authentication required to exploit? Yes
CVSS base score: 8.7
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Notes:

CVE-2026-21311

Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Critical
Authentication required to exploit? Yes
CVSS base score: 8.0
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Notes:

CVE-2026-21309

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Privilege Escalation
Severity: Critical
Authentication required to exploit? Yes
CVSS base score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Notes:

CVE-2026-21285

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Security feature bypass
Severity: Important
Authentication required to exploit? Yes
CVSS base score: 4.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Notes:

CVE-2026-21286

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Security feature bypass
Severity: Important
Authentication required to exploit? Yes
CVSS base score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Notes:

CVE-2026-21291

Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
Authentication required to exploit? Yes
CVSS base score: 4.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Notes:

CVE-2026-21292

Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
Authentication required to exploit? Yes
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Notes:

CVE-2026-21293

Vulnerability category: Server-Side Request Forgery (SSRF) (CWE-918)
Vulnerability impact: Security feature bypass
Severity: Important
Authentication required to exploit? Yes
CVSS base score: 5.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Notes:

CVE-2026-21294

Vulnerability category: Server-Side Request Forgery (SSRF) (CWE-918)
Vulnerability impact: Security feature bypass
Severity: Important
Authentication required to exploit? Yes
CVSS base score: 5.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Notes:

CVE-2026-21359

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Security feature bypass
Severity: Important
Authentication required to exploit? Yes
CVSS base score: 4.7
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L
Notes:

CVE-2026-21360

Vulnerability category: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Vulnerability impact: Security feature bypass
Severity: Important
Authentication required to exploit? Yes
CVSS base score: 6.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Notes:

CVE-2026-21282

Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Security feature bypass
Severity: Important
Authentication required to exploit? Yes
CVSS base score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Notes:

CVE-2026-21310

Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Security feature bypass
Severity: Important
Authentication required to exploit? Yes
CVSS base score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Notes:

CVE-2026-21296

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Security feature bypass
Severity: Important
Authentication required to exploit? Yes
CVSS base score: 4.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Notes:

CVE-2026-21297

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Security feature bypass
Severity: Important
Authentication required to exploit? Yes
CVSS base score: 4.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Notes:

CVE-2026-21295

Vulnerability category: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
Vulnerability impact: Security feature bypass
Severity: Moderate
Authentication required to exploit? Yes
CVSS base score: 3.1
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Notes:

Note

Note: Authentication required to exploit means the vulnerability is exploitable only with credentials. Exploit requires admin privileges means the vulnerability is only exploitable by an attacker with administrative privileges.

style

xl spacing, one up, grid width 8, static-links, xxl-spacing-top

Acknowledgements

Adobe would like to thank the following researchers for reporting these issues and working with Adobe to help protect our customers:

Akash Hamal (akashhamal0x01) -- CVE-2026-21285, CVE-2026-21286, CVE-2026-21296, CVE-2026-21297, CVE-2026-21310
jk-brah -- CVE-2026-21284
Simon M -- CVE-2026-21289
raywolfmaster -- CVE-2026-21290, CVE-2026-21291, CVE-2026-21292
truff -- CVE-2026-21293, CVE-2026-21294, CVE-2026-21361
schemonah -- CVE-2026-21295
archyxsec -- CVE-2026-21311
thlassche -- CVE-2026-21282
0x0.eth (0x0doteth) -- CVE-2026-21309
fqdn -- CVE-2026-21359
icare -- CVE-2026-21360

NOTE: Adobe has a public bug bounty program with Intigriti. If you are interested in working with Adobe as an external security researcher, please check out https://app.intigriti.com/programs/adobe/adobepublic/detail.

For more information, visit https://www.adobe.com/trust/security/bug-bounty.html, or email PSIRT@adobe.com.

CardTitle

APSB26-05

CardDescription

Priority 2 Security update

CardImage

Created

2026-03-10