Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Successful exploitation of CVE-2026-21290 allows an attacker to inject arbitrary JavaScript code into vulnerable form fields within Adobe Commerce. When a user interacts with the affected page – for example, by submitting a form or viewing content containing the injected script – the malicious code executes within their browser context. This can lead to a variety of attacks, including session hijacking, where the attacker gains control of the user's account. The attacker could also steal sensitive information, deface the website, or redirect users to malicious sites. The high confidentiality and integrity impact stems from the potential for complete account compromise and data manipulation.

Organizations utilizing Adobe Commerce versions 0–2.4.4-p16, particularly those with custom extensions or integrations that handle user input, are at significant risk. Shared hosting environments where multiple tenants share the same Adobe Commerce instance are also vulnerable, as an attacker compromising one tenant could potentially exploit this vulnerability to affect others.

• wordpress / composer / npm:

grep -r "<script>" /var/www/html/app/code/Magento/*

• generic web:

curl -I https://your-magento-site.com/form-page | grep Content-Security-Policy

• generic web: Check access and error logs for suspicious POST requests containing <script> tags or other XSS payloads. • generic web: Inspect form field input and output for unexpected HTML or JavaScript code.

1. 2026-03-11Disclosure

   disclosure

1. Reserviert2025-12-12
2. Veröffentlicht2026-03-11
3. Geändert2026-03-12
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-21290 is to upgrade to a patched version of Adobe Commerce. Adobe has released updates to address this vulnerability. If immediate patching is not feasible, consider implementing input validation and output encoding on all user-supplied data to prevent script injection. Web Application Firewalls (WAFs) configured with rules to detect and block XSS payloads can also provide a layer of protection. Regularly review and update security configurations to minimize the attack surface.