APSB26-05 - APSB26-05: Security update available for Adobe Commerce Security Update

📅

Bulletin Information

  • Bulletin ID: APSB26-05
  • Product: APSB26-05: Security update available for Adobe Commerce
  • Published: March 10, 2026
  • Priority: 2
  • Severity: Critical
  • CVE Count: 19

Affected Versions

  • Adobe Commerce: 2.4.9-alpha3 and earlier2.4.8-p3 and earlier2.4.7-p8 and earlier2.4.6-p13 and earlier2.4.5-p15 and earlier2.4.4-p16 and earlier
  • Adobe Commerce B2B: 1.5.3-alpha3 and earlier1.5.2-p3 and earlier1.4.2-p8 and earlier1.3.5-p13 and earlier1.3.4-p15 and earlier1.3.3-p16 and earlier
  • Magento Open Source: 2.4.9-alpha32.4.8-p3 and earlier2.4.7-p8 and earlier2.4.6-p13 and earlier2.4.5-p15 and earlier

Vulnerability Details

Total Vulnerabilities: 19

Severity Breakdown:

  • Moderate: 3
  • Important: 10
  • Critical: 6

Key Vulnerabilities:

1. CVE-2026-21361

  • Category: Cross-site Scripting (Stored XSS) (CWE-79)
  • Impact: Privilege escalation
  • Severity: Critical
  • CVSS Score: 8.1
  • Authentication Required: Yes

2. CVE-2026-21284

  • Category: Cross-site Scripting (Stored XSS) (CWE-79)
  • Impact: Privilege escalation
  • Severity: Critical
  • CVSS Score: 8.1
  • Authentication Required: Yes

3. CVE-2026-21289

  • Category: Incorrect Authorization (CWE-863)
  • Impact: Security feature bypass
  • Severity: Critical
  • CVSS Score: 7.5
  • Authentication Required: Yes

…and 16 more vulnerabilities

CVE Identifiers

CVE-2026-21285, CVE-2026-21310, CVE-2026-21311, CVE-2026-21286, CVE-2026-21294, CVE-2026-21292, CVE-2026-21293, CVE-2026-21289, CVE-2026-21360, CVE-2026-21282, CVE-2026-21291, CVE-2026-21309, CVE-2026-21290, CVE-2026-21296, CVE-2026-21361, CVE-2026-21297, CVE-2026-21359, CVE-2026-21284, CVE-2026-21295

Read Full Bulletin on Adobe Security Portal →

Previous Next Home