What is the CVSS score of CVE-2026-21295?

CVE-2026-21295 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-21295?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Commerce CVE-2026-21295

LOW

URL Redirection to Untrusted Site (Open Redirect) (CWE-601)

2026-03-11 psirt@adobe.com

Open Redirect Adobe Magento Commerce Commerce B2b

3.1

CVSS 3.1 · Vendor: adobe

View

Vulnerability Assessment

Weakness	CWE CWE-601 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V14 - Configuration Dependency management, component inventory MITRE ATT&CK 1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS 3.1 (LOW). Attack vector: Network. Complexity: High. Privileges required: None. User interaction: Required.
Exploit ScenarioDerived	An attacker could exploit this vulnerability to compromise the affected system.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. [CVSS 3.1 LOW]

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Classified as CWE-601 (URL Redirection to Untrusted Site (Open Redirect)). Affects Commerce. Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.

Know when Commerce gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (adobe) PRIMARY 3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

DescriptionCVE.org

Executive ViewAI

Why It Matters

CVE-2026-21295 is a low-severity vulnerability (CVSS 3.1). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.

Business Impact: Low

Compensating Controls

Apply vendor patch during routine maintenance. Standard security controls provide adequate interim protection.

Threat Intelligence Overview

EPSS Score

0.0%

Top 88% exploitable

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC No

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

Low

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +16

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Affected Products (CPE)CVE.org

cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:p10:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:p11:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:p12:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:p13:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:p14:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:p15:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:p16:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:p7:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:p8:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:p9:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*

+ 163 more

Related Vulnerabilities in Adobe Commerce Multiple Vulnerabilities

View all 19

CVE-2026-21291 MEDIUM

4.8

CVE-2026-21311 HIGH

8.0

CVE-2026-21310 MEDIUM

5.3

CVE-2026-21360 MEDIUM

6.8

CVE-2026-21282 MEDIUM

5.3

CVE-2026-21284 HIGH

8.1

CVE-2026-21285 MEDIUM

4.3

CVE-2026-21286 MEDIUM

CVE-2026-21292 MEDIUM

5.4

CVE-2026-21293 MEDIUM

5.5

CVE-2026-21294 MEDIUM

5.5

CVE-2026-21296 MEDIUM

4.3

CVE-2026-21297 MEDIUM

4.3

CVE-2026-21309 HIGH

7.5

CVE-2026-21359 MEDIUM

4.7

CVE-2026-21361 HIGH

8.1

More in Commerce

View all

CVE-2026-71362 CRITICAL Emergency POC

9.1 Aug 11

Privilege escalation in Adobe Commerce and Magento Open Source (including Adobe Commerce B2B) lets a remote attacker gai

CVE-2024-34102 CRITICAL Act Now POC

9.8 Jun 13

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML E

CVE-2021-27602 CRITICAL Act Now

9.9 Apr 13

SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create

CVE-2021-21477 CRITICAL Act Now

9.9 Feb 09

SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools r

CVE-2024-45115 CRITICAL Act Now

9.8 Oct 10

Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication v

CVE-2024-34107 CRITICAL Act Now

9.8 Jun 13

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulne

CVE-2022-34256 CRITICAL Act Now

9.8 Aug 16

Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improp

CVE-2021-42064 CRITICAL Act Now

9.8 Dec 14

If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterize

CVE-2020-6265 CRITICAL Act Now

9.8 Jun 09

SAP Commerce, versions - 6.7, 1808, 1811, 1905, and SAP Commerce (Data Hub), versions - 6.7, 1808, 1811, 1905, allows an

CVE-2024-20717 MEDIUM This Month POC

5.4 Feb 15

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting (XSS) vul

CVE-2026-76201 CRITICAL Act Now

9.3 Sep 08

Stored cross-site scripting in Adobe Commerce, Magento Open Source, and Adobe Commerce B2B lets a remote attacker persis

CVE-2026-76200 CRITICAL Act Now

9.3 Sep 08

Stored cross-site scripting in Adobe Commerce, Magento Open Source, and Adobe Commerce B2B (versions through the August

Same weakness CWE-601 – URL Redirection to Untrusted Site (Open Redirect)

View all

CVE-2017-1000117 HIGH POC

8.8

CVE-2016-5385 HIGH POC

8.1

CVE-2018-11784 MEDIUM POC

4.3

CVE-2017-3528 MEDIUM POC

5.4

CVE-2012-0518 MEDIUM

4.7

CVE-2024-21641 MEDIUM POC

6.5

CVE-2015-5354 MEDIUM POC

5.8

CVE-2024-22891 CRITICAL POC

9.8

References

Advisories & patches

ADVISORY https://helpx.adobe.com/security/products/magento/apsb26-05.html ADVISORY https://vuldb.com/?id.350276

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back