CVE-2026-21361: Adobe Commerce Stored XSS Vulnerability

CVE-2026-21361 Overview

CVE-2026-21361 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The flaw allows a high-privileged attacker to inject malicious JavaScript into vulnerable form fields. When a victim browses to a page rendering the injected payload, the script executes in their browser context. Successful exploitation enables session takeover, leading to high impact on confidentiality and integrity. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact

Attackers with elevated privileges can hijack administrator or customer sessions in Adobe Commerce storefronts, enabling account takeover and unauthorized changes to commerce data.

Affected Products

• Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier
• Adobe Commerce B2B versions 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 and earlier
• Magento Open Source versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15 and earlier

Discovery Timeline

• 2026-03-11 - CVE-2026-21361 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-21361

Vulnerability Analysis

The vulnerability resides in Adobe Commerce form-field handling where user-supplied input is stored and later rendered without proper output encoding. An authenticated attacker with high privileges submits JavaScript through an affected form field. The malicious payload persists in the application database and executes whenever another user, including administrators, visits a page that renders the stored content.

The scope-changed nature of the flaw means injected scripts can interact with browser resources beyond the originally vulnerable component. This expands the blast radius from a single form to any user session that touches the affected page. The vulnerability requires user interaction, as the victim must navigate to the page containing the injected payload.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Adobe Commerce stores attacker-controlled values from specific form fields and reflects them back into HTML responses without sufficient context-aware encoding. The application trusts privileged users to supply safe data, but does not enforce server-side sanitization or contextual escaping at render time.

Attack Vector

Exploitation is network-based and requires the attacker to hold high privileges in the Commerce admin or merchant interface. The attacker authenticates, navigates to a vulnerable form, and submits a payload containing JavaScript. The payload is persisted server-side. When a victim, typically another administrator or customer, loads the affected page, the browser executes the script under the victim's session. The attacker captures session cookies, performs actions as the victim, or pivots to further administrative compromise.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-21361

Indicators of Compromise

• Unexpected <script> tags, javascript: URIs, or event-handler attributes (onerror, onload) stored in Commerce database tables that hold form-field content.
• Outbound HTTP requests from admin or storefront browser sessions to unfamiliar domains, indicating cookie or token exfiltration.
• Admin user accounts created or modified shortly after a privileged user viewed pages containing user-submitted data.
• Anomalous session activity from administrator accounts immediately after rendering a form page.

Detection Strategies

• Scan database fields used by Commerce forms for HTML and JavaScript syntax patterns inconsistent with expected business data.
• Review web server access logs for POST requests submitting payloads containing script tags or encoded JavaScript fragments to admin endpoints.
• Deploy a web application firewall (WAF) rule set that inspects form submissions and flags HTML control characters in fields expected to contain plain text.
• Implement Content Security Policy (CSP) violation reporting to surface inline script execution attempts originating from stored content.

Monitoring Recommendations

• Monitor administrator session creation events for rapid succession of logins from different IP addresses, suggesting session hijacking.
• Alert on changes to admin user roles, permissions, or password resets initiated outside known maintenance windows.
• Track outbound network connections from administrator browsers to non-allowlisted destinations during Commerce admin sessions.

How to Mitigate CVE-2026-21361

Immediate Actions Required

• Apply the security updates released in Adobe Security Bulletin APSB26-05 to all Adobe Commerce, Commerce B2B, and Magento Open Source instances.
• Audit high-privileged accounts and remove unnecessary administrative access to reduce the population of users capable of exploiting the flaw.
• Rotate administrator session tokens and force re-authentication after patching to invalidate any sessions captured prior to remediation.
• Review stored form-field content in the database for existing malicious payloads and sanitize identified entries.

Patch Information

Adobe published fixes in the March 2026 security release. Refer to the Adobe Security Advisory for Magento (APSB26-05) for version-specific patch details. Upgrade to a version newer than 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, or 2.4.4-p16 as applicable to your deployment branch.

Workarounds

• Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
• Restrict access to administrative form interfaces using IP allowlists or VPN-only access until patches are applied.
• Deploy WAF rules that block HTML and JavaScript syntax in form fields expected to contain alphanumeric content.

# Example Content Security Policy header for nginx reverse proxy fronting Adobe Commerce
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report";