CVE-2026-21290Disclosure(adobe / commerce)

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field.

adobe CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://helpx.adobe.com/security/products/magento/apsb26-05.html

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

commerce
commerce_b2b
magento

Threat summary

4 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 1d ago at 3 mentions (2026-03-11); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

adobe

Products

commercecommerce_b2bmagento

12 versions affected across 3 products

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

375.0%

General

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-11	3	Disclosure3
2026-03-12	1	General1

Full discourse4 posts

RedPacket Security@RedPacketSec211d
General
CVE Alert: CVE-2026-21290 - Adobe - Adobe Commerce - https://www.redpacketsecurity.com/cve-alert-cve-2026-21290-adobe-adobe-commerce/ #OSINT #ThreatIntel #CyberSecurity #cve-2026-21290 #adobe #adobe-commerce
Post summary
The text announces a CVE alert for Adobe Commerce, providing a link to an advisory page but offering no additional technical, exploit, or mitigation details.
0000061
3.5K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds211d
Disclosure
CVE-2026-21290 Stored Cross-Site Scripting Vulnerability in Adobe Commerce Versions Prior to 2.4.9-alpha3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-21290
Post summary
The post provides a brief disclosure of CVE-2026-21290, identifying a stored XSS flaw in Adobe Commerce versions before 2.4.9‑alpha3, and directs readers to a vulnerability details page.
0000012
4.0K followersView on X
CVE@CVEnew212d
Disclosure
CVE-2026-21290 Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerabilit… https://www.cve.org/CVERecord?id=CVE-2026-21290
Post summary
The post announces CVE‑2026‑21290, detailing affected Adobe Commerce versions and describing it as a stored XSS vulnerability, but provides no PoC, exploit code, active exploitation claim, or patch information.
00000109
56.7K followersView on X
CVEFind.com@CveFindCom212d
Disclosure
[CVE-2026-21290: HIGH] Critical stored Cross-Site Scripting (XSS) vulnerability in Adobe Commerce versions 2.4.9-alpha3 and earlier allows session takeover via malicious scripts injected by attackers.#cve,CVE-2026-21290,#cybersecurity https://cvefind.com/CVE-2026-21290
Post summary
The post announces a critical stored XSS vulnerability (CVE‑2026‑21290) in Adobe Commerce that could enable session takeover, but it provides no PoC, exploit code, active exploitation evidence, or patch/workaround information.
0000037
601 followersView on X

CPE platform detail183 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

183 of 183 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	adobe	commerce	-	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.7	-	-
App	adobe	commerce	2.4.7	-	-
App	adobe	commerce	2.4.7	-	-
App	adobe	commerce	2.4.7	-	-
App	adobe	commerce	2.4.7	-	-
App	adobe	commerce	2.4.7	-	-
App	adobe	commerce	2.4.7	-	-
App	adobe	commerce	2.4.7	-	-
App	adobe	commerce	2.4.7	-	-
App	adobe	commerce	2.4.7	-	-
App	adobe	commerce	2.4.7	-	-
App	adobe	commerce	2.4.7	-	-
App	adobe	commerce	2.4.8	-	-
App	adobe	commerce	2.4.8	-	-
App	adobe	commerce	2.4.8	-	-
App	adobe	commerce	2.4.8	-	-
App	adobe	commerce	2.4.8	-	-
App	adobe	commerce	2.4.8	-	-
App	adobe	commerce	2.4.9	-	-
App	adobe	commerce	2.4.9	-	-
App	adobe	commerce	2.4.9	-	-
App	adobe	commerce_b2b	-	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.5	-	-
App	adobe	commerce_b2b	1.3.5	-	-
App	adobe	commerce_b2b	1.3.5	-	-
App	adobe	commerce_b2b	1.3.5	-	-
App	adobe	commerce_b2b	1.3.5	-	-
App	adobe	commerce_b2b	1.3.5	-	-
App	adobe	commerce_b2b	1.3.5	-	-
App	adobe	commerce_b2b	1.3.5	-	-
App	adobe	commerce_b2b	1.3.5	-	-
App	adobe	commerce_b2b	1.3.5	-	-
App	adobe	commerce_b2b	1.3.5	-	-
App	adobe	commerce_b2b	1.3.5	-	-
App	adobe	commerce_b2b	1.3.5	-	-
App	adobe	commerce_b2b	1.3.5	-	-
App	adobe	commerce_b2b	1.4.2	-	-
App	adobe	commerce_b2b	1.4.2	-	-
App	adobe	commerce_b2b	1.4.2	-	-
App	adobe	commerce_b2b	1.4.2	-	-
App	adobe	commerce_b2b	1.4.2	-	-
App	adobe	commerce_b2b	1.4.2	-	-
App	adobe	commerce_b2b	1.4.2	-	-
App	adobe	commerce_b2b	1.4.2	-	-
App	adobe	commerce_b2b	1.4.2	-	-
App	adobe	commerce_b2b	1.5.2	-	-
App	adobe	commerce_b2b	1.5.2	-	-
App	adobe	commerce_b2b	1.5.2	-	-
App	adobe	commerce_b2b	1.5.2	-	-
App	adobe	commerce_b2b	1.5.3	-	-
App	adobe	commerce_b2b	1.5.3	-	-
App	adobe	commerce_b2b	1.5.3	-	-
App	adobe	magento	-	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.7	-	-
App	adobe	magento	2.4.7	-	-
App	adobe	magento	2.4.7	-	-
App	adobe	magento	2.4.7	-	-
App	adobe	magento	2.4.7	-	-
App	adobe	magento	2.4.7	-	-
App	adobe	magento	2.4.7	-	-
App	adobe	magento	2.4.7	-	-
App	adobe	magento	2.4.7	-	-
App	adobe	magento	2.4.7	-	-
App	adobe	magento	2.4.7	-	-
App	adobe	magento	2.4.7	-	-
App	adobe	magento	2.4.8	-	-
App	adobe	magento	2.4.8	-	-
App	adobe	magento	2.4.8	-	-
App	adobe	magento	2.4.8	-	-
App	adobe	magento	2.4.8	-	-
App	adobe	magento	2.4.8	-	-
App	adobe	magento	2.4.9	-	-

Explore more

Back to dashboard adobe CVEs commerce vulnerabilities

What researchers are saying

CVE-2026-21290

RedPacket Security@RedPacketSecGeneral

The text announces a CVE alert for Adobe Commerce, providing a link to an advisory page but offering no additional technical, exploit, or mitigation details.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post provides a brief disclosure of CVE-2026-21290, identifying a stored XSS flaw in Adobe Commerce versions before 2.4.9‑alpha3, and directs readers to a vulnerability details page.

CVE@CVEnewDisclosure

The post announces CVE‑2026‑21290, detailing affected Adobe Commerce versions and describing it as a stored XSS vulnerability, but provides no PoC, exploit code, active exploitation claim, or patch information.

CVEFind.com@CveFindComDisclosure

The post announces a critical stored XSS vulnerability (CVE‑2026‑21290) in Adobe Commerce that could enable session takeover, but it provides no PoC, exploit code, active exploitation evidence, or patch/workaround information.