CVE-2026-21292: XSS in Adobe Commerce

Successful exploitation of CVE-2026-21292 allows an attacker to inject arbitrary JavaScript code into vulnerable form fields within Adobe Commerce. This code executes in the context of the user's browser when they interact with the affected page. The impact can range from simple defacement of the page to more severe consequences like session hijacking, phishing attacks, or redirection to malicious websites. Because the attack requires user interaction (browsing to the vulnerable page), the attacker needs to entice a victim to visit the compromised area. The blast radius is limited to users who interact with the injected script, but this could encompass a significant portion of the Commerce platform's user base.

1. Reserved2025-12-12
2. Published2026-03-11
3. EPSS updated2026-03-23

The primary mitigation for CVE-2026-21292 is to upgrade Adobe Commerce to a version that includes the security patch. Adobe has released fixes for affected versions. If immediate upgrading is not possible, consider implementing input validation and output encoding on form fields to sanitize user-supplied data. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Regularly review and update security policies and conduct penetration testing to identify and address potential vulnerabilities.