CVE-2026-21361
Published: 11 March 2026
Summary
CVE-2026-21361 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Adobe Commerce. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 31.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-22 (Publicly Accessible Content) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates inputs to vulnerable form fields in Adobe Commerce, preventing high-privileged attackers from injecting malicious JavaScript.
Filters outputs when rendering pages with vulnerable form fields, blocking execution of stored malicious scripts in victims' browsers.
Checks publicly accessible content in Adobe Commerce for interpretative objects like injected JavaScript prior to serving to victims.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS enables injection and execution of malicious JavaScript (T1059.007) in victims' browsers, facilitating web session cookie theft (T1539) for session takeover.
NVD Description
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vvulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be…
more
executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field.
Deeper analysisAI
CVE-2026-21361 is a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) affecting Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16, and earlier. Published on 2026-03-11, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N). The flaw enables a high-privileged attacker to inject malicious scripts into vulnerable form fields.
A high-privileged attacker (PR:H) can exploit this vulnerability over the network (AV:N) with low complexity (AC:L) by injecting malicious JavaScript into affected form fields. When a victim browses to the page containing the injected script, it executes in their browser (UI:R), potentially enabling session takeover and resulting in high confidentiality and integrity impacts (C:H/I:H) due to the changed scope (S:C).
The Adobe security advisory provides details on mitigation; see https://helpx.adobe.com/security/products/magento/apsb26-05.html.
Details
- CWE(s)