4.7mediumMedium
CVE-2026-21359
Adobe Commerce
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and have limited impact to the integrity and availability of data. The exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.
Exploitation status
- A vendor advisory or patch reference has been published.
What the metrics mean
- It is reachable over a network, without needing local access.
- For an attacker who can reach it, exploitation depends on conditions outside the attacker's control.
- To exploit it, no account is needed.
- Beyond that, someone has to be persuaded to take an action first.
Scoring
- CVSS
- 4.7 (v3.1)
- Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L- Weakness
- CWE-863
- Assigned by
- psirt@adobe.com
Dates
- Published
- 2026-03-11
- Last modified
- 2026-08-28
- Sources
- NVD
Affected products
- Adobe Commerce- 2.4.4, 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9
- Adobe Commerce B2b- 1.3.3, 1.3.3, 1.3.4, 1.3.5, 1.4.2, 1.5.2, 1.5.3
- Adobe Magento- 2.4.5, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9
As listed in the NVD configuration data. Not a statement about your estate.