CVE-2026-21284
Published: 11 March 2026
Summary
CVE-2026-21284 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Adobe Commerce. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-21284 is a stored Cross-Site Scripting (XSS) vulnerability, classified under CWE-79, affecting Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16, and earlier. The flaw allows injection of malicious scripts into vulnerable form fields, with a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N). It was published on 2026-03-11.
A high-privileged attacker can exploit this vulnerability over the network with low complexity by injecting malicious JavaScript into affected form fields. Exploitation requires a victim to browse to the page containing the injected content, at which point the script executes in the victim's browser. Successful attacks enable session takeover, resulting in high confidentiality and integrity impacts, though availability is unaffected.
For mitigation details, refer to the Adobe Product Security Bulletin at https://helpx.adobe.com/security/products/magento/apsb26-05.html.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11037
Vulnerability details
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be…
more
executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing Adobe Commerce enables exploitation of the application (T1190) to inject and execute malicious JavaScript in victims' browsers, facilitating web session cookie theft (T1539) for session takeover.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Filters information output to web pages to prevent execution of injected malicious JavaScript in victims' browsers when accessing pages with vulnerable form fields.
Validates inputs to vulnerable form fields to block injection of malicious scripts by high-privileged attackers.
Remediates the stored XSS flaw in affected Adobe Commerce versions by applying vendor-provided patches from APSB26-05.