What is the CVSS score of CVE-2021-36028?

CVE-2021-36028 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 2.9%.

Is there a patch available for CVE-2021-36028?

Yes, a patch is available for CVE-2021-36028. Update the affected software to the latest version immediately.

Adobe Commerce CVE-2021-36028

HIGH

XML Injection (aka Blind XPath Injection) (CWE-91)

2021-09-01 psirt@adobe.com

RCE Adobe Adobe Commerce Magento Open Source

7.2

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-91 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization XPath query parameterization
Impact	CVSS score of 7.2 (HIGH). Attack characteristics: network attack vector, low complexity, high privileges required, no user interaction not required.
Exploit ScenarioDerived	This vulnerability can be exploited remotely over the network. Successful exploitation could compromise the high-severity affected system.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 2.9% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability when saving a configurable product. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Affected Packages

composer magento/community-edition fix: 2.3.7-p1, 2.4.2-p2

composer magento/project-community-edition no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in composer

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability is classified under CWE-91. Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability when saving a configurable product. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. Affected products include: Adobe Adobe Commerce, Adobe Magento Open Source.

Know when Adobe Commerce gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionNVD

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability when saving a configurable product. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.

Threat Intelligence Overview

EPSS Score

2.9%

Top 15% exploitable

Data Quality

2 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 2.9%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +3

CVSS: +36

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)NVD

cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*

cpe:2.3:a:adobe:adobe_commerce:2.4.2:p1:*:*:*:*:*:*

cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*

cpe:2.3:a:adobe:magento_open_source:2.4.2:p1:*:*:*:*:*:*

More in Adobe Commerce

View all

CVE-2026-75650 CRITICAL Emergency POC

10.0 Sep 07

Server-side template injection in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows remote unauthentica

CVE-2026-48356 CRITICAL Act Now

9.3 Jul 14

Arbitrary code execution in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plu

CVE-2026-47992 HIGH Act Now

7.2 Jul 14

SQL injection in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin allows

CVE-2026-47996 MEDIUM This Month

6.8 Jul 14

Security feature bypass in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks plug

CVE-2026-103849 CRITICAL Act Now

10.0 Oct 13

Unauthenticated remote code execution affects Adobe Commerce, Adobe Commerce B2B, and Magento Open Source through improp

CVE-2026-92909 CRITICAL Act Now

9.8 Oct 13

Remote, low-complexity code execution is possible in Adobe Commerce, Adobe Commerce B2B and Magento Open Source through

CVE-2021-36020 CRITICAL Act Now

9.8 Sep 01

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Inj

CVE-2026-100133 CRITICAL Act Now

9.3 Oct 13

Stored cross-site scripting in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows a remote attacker to p

CVE-2026-91013 CRITICAL Act Now

9.3 Oct 13

Stored cross-site scripting (XSS) in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows an attacker who

CVE-2026-48358 CRITICAL Act Now

9.1 Jul 14

Arbitrary code execution in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plu

CVE-2026-92464 CRITICAL Act Now

9.1 Oct 13

Arbitrary code execution is achievable in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source by an attacker who

CVE-2026-47994 HIGH This Week

8.7 Jul 14

Stored cross-site scripting in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source lets a low-privileged authent

Same weakness CWE-91 – XML Injection (aka Blind XPath Injection)

View all

CVE-2020-0646 CRITICAL POC

9.8

CVE-2023-46214 HIGH POC

8.8

CVE-2023-27253 HIGH POC

8.8

CVE-2013-7429 CRITICAL POC

9.8

CVE-2023-43187 CRITICAL POC

9.8

CVE-2019-17626 CRITICAL POC

9.8

CVE-2019-16941 CRITICAL POC

9.8

CVE-2019-14277 CRITICAL POC

9.8

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2017-7269 CRITICAL POC

9.8

CVE-2022-47966 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2023-3519 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2016-4117 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

References

Advisories & patches

PATCH https://helpx.adobe.com/security/products/magento/apsb21-64.html

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back