CVE-2026-21289
Published: 11 March 2026
Summary
CVE-2026-21289 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Adobe Commerce. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Periodic review and update of procedures reduces incorrect authorization implementations over time.
Supervision identifies cases where authorization logic incorrectly permits unauthorized actions.
Defining permitted attribute values and auditing modifications reduces the chance of incorrect authorization outcomes due to tampered or missing labels.
The authorization process and usage restrictions help prevent incorrect authorization for remote access types.
Establishing configuration and connection requirements helps ensure correct rather than incorrect authorization for wireless access.
Establishing connection authorization processes for mobile devices helps ensure authorization decisions are correctly implemented rather than incorrect.
Monitoring account use, notifying on changes, and reviewing accounts for compliance corrects incorrect authorization assignments.
Ensures authorization decisions for external system use are correctly implemented and enforced.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct mapping to exploitation of a public-facing web application (Adobe Commerce) via an authorization bypass vulnerability allowing unauthenticated data access.
NVD Description
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized view…
more
access of data. Exploitation of this issue does not require user interaction.
Deeper analysisAI
CVE-2026-21289 is an Incorrect Authorization vulnerability (CWE-863) affecting Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16, and earlier releases. The flaw enables a security feature bypass, allowing attackers to gain unauthorized view access to data. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and was published on 2026-03-11.
The vulnerability can be exploited by an unauthenticated attacker over the network with low attack complexity and no user interaction required. Successful exploitation bypasses security controls, resulting in high-impact unauthorized access to view sensitive data, though it does not affect integrity or availability.
Adobe's security advisory APSB26-05 provides details on mitigation and patches, available at https://helpx.adobe.com/security/products/magento/apsb26-05.html.
Details
- CWE(s)