What is the CVSS score of CVE-2026-21361?

CVE-2026-21361 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Commerce B2b are affected by CVE-2026-21361?

Adobe Commerce installations running versions 2.4.9-alpha3 through 2.4.4-p16 are vulnerable to stored XSS attacks that could allow privileged administrators to inject malicious code into the…

How to fix or mitigate CVE-2026-21361?

Within 24 hours: Inventory all Adobe Commerce deployments and confirm which versions are running; restrict administrative access to form fields identified in vendor security bulletins and implement enhanced monitoring of admin activity. Within 7 days: Deploy Web Application Firewall (WAF) rules to sanitize form inputs and block suspicious payloads; segment admin interfaces from public networks where possible. Within 30 days: Develop and test a patching plan; coordinate with Adobe for patch availability and apply immediately upon release, or implement compensating controls permanently if patching timeline extends beyond 30 days.

Commerce B2b CVE-2026-21361

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-11 psirt@adobe.com

Adobe XSS Commerce B2b Magento Commerce

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 03:15 nvd

HIGH 8.1

DescriptionCVE.org

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vvulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field.

AnalysisAI

Stored XSS in Adobe Commerce versions 2.4.9-alpha3 through 2.4.4-p16 allows high-privileged attackers to inject malicious scripts into form fields, which execute when victims visit the affected pages. Successful exploitation enables session hijacking and compromise of user confidentiality and integrity, though user interaction is required for the attack to succeed. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Commerce. Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vvulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.