CVE-2026-21284: XSS in Adobe Commerce

This XSS vulnerability allows an attacker to inject arbitrary JavaScript code into form fields within Adobe Commerce. When a user interacts with a page containing the injected script – for example, by submitting a form or simply viewing the page – the malicious script executes within their browser context. This can lead to a variety of attacks, including session hijacking, where the attacker gains control of the user's account. The attacker could also steal sensitive data, deface the website, or redirect users to malicious sites. The high privilege requirement suggests that the vulnerability might be exploitable by administrators or users with elevated permissions within the Adobe Commerce environment, significantly expanding the potential impact.

1. Reserved2025-12-12
2. Published2026-03-11
3. Modified2026-03-12
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-21284 is to upgrade Adobe Commerce to a version that includes the security patch. Adobe recommends upgrading to the latest available version. If immediate upgrading is not possible, consider implementing a Web Application Firewall (WAF) with rules to detect and block XSS attempts targeting the vulnerable form fields. Input validation and output encoding on the server-side can also help reduce the attack surface. Thoroughly review and sanitize all user-supplied input before rendering it in web pages.