CVE-2026-21284
Published: 11 March 2026
Description
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be…
more
executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field.
Mitigating Controls (NIST 800-53 r5)AI
Filters information output to web pages to prevent execution of injected malicious JavaScript in victims' browsers when accessing pages with vulnerable form fields.
Validates inputs to vulnerable form fields to block injection of malicious scripts by high-privileged attackers.
Remediates the stored XSS flaw in affected Adobe Commerce versions by applying vendor-provided patches from APSB26-05.
Security SummaryAI
CVE-2026-21284 is a stored Cross-Site Scripting (XSS) vulnerability, classified under CWE-79, affecting Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16, and earlier. The flaw allows injection of malicious scripts into vulnerable form fields, with a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N). It was published on 2026-03-11.
A high-privileged attacker can exploit this vulnerability over the network with low complexity by injecting malicious JavaScript into affected form fields. Exploitation requires a victim to browse to the page containing the injected content, at which point the script executes in the victim's browser. Successful attacks enable session takeover, resulting in high confidentiality and integrity impacts, though availability is unaffected.
For mitigation details, refer to the Adobe Product Security Bulletin at https://helpx.adobe.com/security/products/magento/apsb26-05.html.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing Adobe Commerce enables exploitation of the application (T1190) to inject and execute malicious JavaScript in victims' browsers, facilitating web session cookie theft (T1539) for session takeover.