CVE-2026-21361: Adobe Commerce · Cross-site Scripting
Affects Adobe CommerceSource CVE Database V5
Not known to be exploited · CVSS 8.1 High.
Data as of 30 Oct 2026, 11:52 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 40% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:NExploitation evidence
Disclosed: evidence found.
CVE published 11 Mar 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| AdobeAdobe Commerce | Affected
| Fixed in– |
| AdobeAdobe Commerce B2B | Affected
| Fixed in– |
| AdobeMagento Open Source | Affected
| Fixed in– |
AI-suggested
- Apply official patches from Adobe as soon as they become available to address the vulnerability directly.
- Implement strict input validation and output encoding on all form fields to prevent injection of malicious scripts.
- Restrict administrative privileges to the minimum necessary and monitor for unusual activities to reduce the risk of high-privileged account compromise.
- Employ Content Security Policy (CSP) headers to limit the execution of unauthorized scripts in browsers.
- Conduct regular security audits and penetration testing focused on XSS vulnerabilities within the Adobe Commerce environment.
- Educate users and administrators about phishing and social engineering tactics to reduce the likelihood of victims visiting malicious pages.
- Use web application firewalls (WAFs) with rules designed to detect and block XSS payloads targeting Adobe Commerce.
- Monitor logs for suspicious input patterns or repeated access to vulnerable pages to detect exploitation attempts early.
Description
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vvulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field.