Commerce Adobe Commerce

  1. Vendors
  2. Adobe
  3. Commerce

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in Adobe Commerce.

Recent Adobe Commerce Security Advisories

Advisory Title Published
APSB26-73 Security Updates Available for Adobe Commerce | APSB26-73 July 14, 2026
APSB26-49 Security Updates Available for Adobe Commerce | APSB26-49 May 12, 2026
APSB26-05 Security Updates Available for Adobe Commerce | APSB26-05 March 10, 2026
APSB25-94 Security Updates Available for Adobe Commerce | APSB25-94 October 14, 2025
APSB25-88 Security Updates Available for Adobe Commerce | APSB25-88 September 9, 2025
APSB25-71 Security Updates Available for Adobe Commerce | APSB25-71 August 12, 2025
APSB25-50 Security Updates Available for Adobe Commerce | APSB25-50 June 10, 2025
APSB25-26 Security Updates Available for Adobe Commerce | APSB25-26 April 8, 2025
APSB25-08 Security Updates Available for Adobe Commerce | APSB25-08 February 11, 2025
APSB24-90 Security Updates Available for Adobe Commerce | APSB24-90 November 12, 2024

By the Year

In 2026 there have been 48 vulnerabilities in Adobe Commerce with an average score of 6.4 out of ten. Last year, in 2025 Commerce had 54 security vulnerabilities published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in Commerce in 2026 could surpass last years number. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.03.




Year Vulnerabilities Average Score
2026 48 6.44
2025 54 6.41
2024 63 6.03
2023 30 6.04
2022 12 6.96
2021 1 6.50

It may take a day or so for new Commerce vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Adobe Commerce Security Vulnerabilities

Adobe Commerce Incorrect Auth Bypass (CVE-2026-47984)
CVE-2026-47984 8.2 - High - July 14, 2026

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction.

AuthZ

Adobe Commerce Incorrect Auth Bypass - CVE-2026-47997
CVE-2026-47997 5.9 - Medium - July 14, 2026

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

AuthZ

Adobe Commerce Auth Bypass CVE-2026-47988
CVE-2026-47988 8.6 - High - July 14, 2026

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction.

AuthZ

Adobe Commerce Improper Encoding/Escaping leads to arbitrary code exec
CVE-2026-48358 9.1 - Critical - July 14, 2026

Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Output Sanitization

Stored XSS via privileged attacker in Adobe Commerce
CVE-2026-47999 4.8 - Medium - July 14, 2026

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

XSS

Adobe Commerce Unrestricted File Upload RCE via Dangerous Upload
CVE-2026-48356 9.3 - Critical - July 14, 2026

Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

Unrestricted File Upload

Adobe Commerce Open Redirect Vulnerability (CVE-2026-48000)
CVE-2026-48000 4.3 - Medium - July 14, 2026

Adobe Commerce is affected by an Improper Redirect (Open Redirect) vulnerability that could result in a Security feature bypass. An attacker could construct a malicious URL that redirects a victim to an attacker-controlled site, potentially enabling credential theft and account takeover. Exploitation of this issue requires user interaction in that a victim must click on a malicious link.

Open Redirect

Adobe Commerce Incorrect Auth Bypass (CVE-2026-47998)
CVE-2026-47998 5.9 - Medium - July 14, 2026

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

AuthZ

Adobe Commerce stored XSS in form field
CVE-2026-47995 8.1 - High - July 14, 2026

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

XSS

Adobe Commerce Info Exposure CVE-2026-48001
CVE-2026-48001 3.7 - Low - July 14, 2026

Adobe Commerce is affected by an Information Exposure vulnerability that could lead to a limited disclosure of sensitive information. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

Information Disclosure

Adobe Commerce stored XSS in form fields enables lowprivileged attacker
CVE-2026-48371 5.4 - Medium - July 14, 2026

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

XSS

Adobe Commerce Auth Bypass: Unauthorized Read via Incorrect Auth
CVE-2026-47996 7.6 - High - July 14, 2026

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. Scope is changed.

AuthZ

Adobe Commerce Stored XSS in Form Fields
CVE-2026-47994 8.7 - High - July 14, 2026

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

XSS

Adobe Commerce SQLi Vulnerability (CVE-2026-47992)
CVE-2026-47992 7.2 - High - July 14, 2026

Adobe Commerce is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could exploit this vulnerability to execute malicious SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction.

SQL Injection

Improper Authorization in Adobe Commerce <2.5 Bypass Write Access
CVE-2026-34656 4.3 - Medium - May 12, 2026

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.

AuthZ

Adobe Commerce <=2.4.9-beta1 XSS in form fields
CVE-2026-34658 4.8 - Medium - May 12, 2026

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

XSS

Uncontrolled Resource Consumption in Adobe Commerce <2.4.9-beta1 (DoS)
CVE-2026-34650 7.5 - High - May 12, 2026

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

Resource Exhaustion

Adobe Commerce <=2.4.9-beta1 Stored XSS in Form Fields
CVE-2026-34686 8.7 - High - May 12, 2026

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

XSS

Adobe Commerce SSRF Bypass (v2.4.9-beta1 & earlier)
CVE-2026-34647 7.4 - High - May 12, 2026

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

SSRF

Adobe Commerce 2.4.x Improper Input Validation Security Feature Bypass
CVE-2026-34685 3.4 - Low - May 12, 2026

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

Improper Input Validation

Adobe Commerce 2.4.9-beta1 & earlier Path Traversal: FS Read/Write
CVE-2026-34653 8.7 - High - May 12, 2026

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system read and write. An authenticated attacker with administrative privileges could exploit this vulnerability to read or write files outside the restricted directory. Exploitation of this issue does not require user interaction. Scope is changed.

Directory traversal

Adhoc Third-Party Dep Crash: Adobe Commerce <=2.4.9-beta1 (DOS)
CVE-2026-34652 7.5 - High - May 12, 2026

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Dependency on Vulnerable Third-Party Component vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

1395

Adobe Commerce 2.4.9-beta1-2.4.4-p17 Incorrect Auth Bypass
CVE-2026-34645 7.5 - High - May 12, 2026

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

AuthZ

Adobe Commerce Uncontrolled Resource Consumption Vulnerability (DoS) v<=2.4.9-beta1
CVE-2026-34648 7.5 - High - May 12, 2026

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

Resource Exhaustion

Adobe Commerce Uncontrolled Resource Consumption DoS (pre 2.4.9-beta1)
CVE-2026-34649 7.5 - High - May 12, 2026

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

Resource Exhaustion

Adobe Commerce <=2.4.9-beta1 Stored XSS in Form Fields
CVE-2026-34655 4.8 - Medium - May 12, 2026

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

XSS

Adobe Commerce Uncontrolled Resource Consumption DoS before 2.4.9-beta1
CVE-2026-34651 7.5 - High - May 12, 2026

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

Resource Exhaustion

Adobe Commerce <2.4.9-beta1 Dependency Third-Party Component DoS
CVE-2026-34654 5.3 - Medium - May 12, 2026

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Dependency on Vulnerable Third-Party Component vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

1395

Adobe Commerce 2.4.8-p4 & earlier: Incorrect Auth bypass for write access
CVE-2026-34646 7.5 - High - May 12, 2026

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

AuthZ

Adobe Commerce 2.4.x XSS in Stored Form Fields
CVE-2026-21291 4.8 - Medium - March 11, 2026

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field.

XSS

Adobe Commerce SSRF Bypass 2.4.x
CVE-2026-21293 5.5 - Medium - March 11, 2026

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A high-privileged attacker could exploit this vulnerability to manipulate server-side requests and access unauthorized resources. Exploitation of this issue does not require user interaction.

SSRF

Improper Input Validation in Adobe Commerce 2.4.9-alpha3 & prior leads to DoS
CVE-2026-21282 5.3 - Medium - March 11, 2026

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Improper Input Validation vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability by providing specially crafted input, causing limited impact to application availability. Exploitation of this issue does not require user interaction.

Improper Input Validation

Adobe Commerce <=2.4.9-alpha3: Auth Bypass via Incorrect Authorization
CVE-2026-21286 5.3 - Medium - March 11, 2026

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized view access of data. Exploitation of this issue does not require user interaction.

AuthZ

Adobe Commerce SSRF before 2.4.9-a3 & 2.4.8-p3 (Security bypass)
CVE-2026-21294 5.5 - Medium - March 11, 2026

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A high-privileged attacker could exploit this vulnerability to manipulate server-side requests and bypass security controls. Exploitation of this issue does not require user interaction.

SSRF

Adobe Commerce <2.4.9-alpha3 XSS Vulnerability
CVE-2026-21284 8.1 - High - March 11, 2026

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victims browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field.

XSS

Adobe Commerce 2.4.x Incorrect Auth: Security Feature Bypass (CVE-2026-21297)
CVE-2026-21297 4.3 - Medium - March 11, 2026

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized access to a feature. Exploitation of this issue does not require user interaction.

AuthZ

Adobe Commerce Incorrect Auth 2.4.9-alpha32.4.4-p16
CVE-2026-21359 4.7 - Medium - March 11, 2026

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and have limited impact to the integrity and availability of data. The exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

AuthZ

Adobe Commerce 2.4.x Auth Bypass (Security Feature Exemption)
CVE-2026-21309 7.5 - High - March 11, 2026

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized view access of data. Exploitation of this issue does not require user interaction.

AuthZ

Adobe Commerce XSS in Form Fields v2.4.9-alpha3 & Earlier
CVE-2026-21292 5.4 - Medium - March 11, 2026

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker attacker to inject malicious scripts into vulnerable form fields. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field.

XSS

Adobe Commerce Improper Input Validation, pre-2.4.9-alpha3
CVE-2026-21310 5.3 - Medium - March 11, 2026

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass, with limited impact to integrity. Exploitation of this issue does not require user interaction.

Improper Input Validation

Adobe Commerce v2.4.x Incorrect Auth Bypass (Before 2.4.9-alpha3)
CVE-2026-21285 4.3 - Medium - March 11, 2026

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized access to a feature. Exploitation of this issue does not require user interaction.

AuthZ

Adobe Commerce XSS in form fields pre-2.4.9 enables session hijack
CVE-2026-21290 8.7 - High - March 11, 2026

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victims browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field.

XSS

Adobe Commerce 2.4.x Stored XSS before 2.4.9-alpha3 (CVE-2026-21361)
CVE-2026-21361 8.1 - High - March 11, 2026

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vvulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victims browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field.

XSS

Adobe Commerce <=2.4.93: Incorrect Auth Bypass (SECAUTH)
CVE-2026-21289 7.5 - High - March 11, 2026

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized view access of data. Exploitation of this issue does not require user interaction.

AuthZ

Adobe Commerce 2.4.5-P15 & earlier Path Traversal (2.4.9alpha3)
CVE-2026-21360 6.8 - Medium - March 11, 2026

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to access unauthorized files or directories outside the intended restricted path. Exploitation of this issue does not require user interaction.

Directory traversal

Adobe Commerce 2.4.9-alpha3 Incorrect Auth Bypass (Security Feature)
CVE-2026-21296 4.3 - Medium - March 11, 2026

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized view access of data. Exploitation of this issue does not require user interaction.

AuthZ

Adobe Commerce <2.4.9 stored XSS in form fields
CVE-2026-21311 8 - High - March 11, 2026

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victims browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field.

XSS

Adobe Commerce 2.4.9-alpha3 & earlier: Open Redirect Vulnerability
CVE-2026-21295 3.1 - Low - March 11, 2026

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.

Open Redirect

Adobe Commerce 2.4.9-alpha2 and earlier: Incorrect Authorization (Bypass Auth)
CVE-2025-54267 6.5 - Medium - October 14, 2025

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access to elevated privileges that increase integrity impact to high. Exploitation of this issue does not require user interaction.

AuthZ

Adobe Commerce CrossSite Scripting (XSS) in form fields (v2.4.*)
CVE-2025-54266 4.8 - Medium - October 14, 2025

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victims browser when they browse to the page containing the vulnerable field. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field. Scope is changed.

XSS

Stay on top of Security Vulnerabilities

Want an email whenever new vulnerabilities are published for Adobe Commerce or by Adobe? Click the Watch button to subscribe.

Adobe
Vendor

Adobe Commerce
Product

subscribe