CVE-2026-21290: XSS in Adobe Commerce

Successful exploitation of CVE-2026-21290 allows an attacker to inject arbitrary JavaScript code into vulnerable form fields within Adobe Commerce. When a victim interacts with a page containing the injected script, the malicious code executes within their browser context. This can lead to several severe consequences, including session hijacking, where the attacker gains control of the victim's account. Furthermore, the attacker could potentially steal sensitive data, modify website content, or redirect users to malicious sites. The high confidentiality and integrity impact stems from the potential for complete account compromise and data manipulation.

1. Reserved2025-12-12
2. Published2026-03-11
3. Modified2026-03-12
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-21290 is to upgrade to a patched version of Adobe Commerce. Adobe has released updates to address this vulnerability; refer to the official Adobe Security Bulletin for specific version details. If immediate patching is not feasible, consider implementing input validation and output encoding on all form fields to sanitize user-supplied data. Web Application Firewalls (WAFs) configured with rules to detect and block XSS payloads can also provide an additional layer of defense. Regularly review and update security configurations to minimize the attack surface.