CVE-2026-21293: Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)

Q: What is the severity of CVE-2026-21293?

CVE-2026-21293 is classified as a high severity vulnerability due to its potential for security feature bypass.

Q: How do I fix CVE-2026-21293?

To fix CVE-2026-21293, update Adobe Commerce to the latest version beyond 2.4.9-alpha3.

Q: What systems are affected by CVE-2026-21293?

CVE-2026-21293 affects Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier.

Q: What type of vulnerability is CVE-2026-21293?

CVE-2026-21293 is a Server-Side Request Forgery (SSRF) vulnerability.

Q: What could be the consequences of exploiting CVE-2026-21293?

Exploiting CVE-2026-21293 could allow an attacker to bypass security features, leading to unauthorized access or information disclosure.

Published Mar 10, 2026

Updated

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A high-privileged attacker could exploit this vulnerability to manipulate server-side requests and access unauthorized resources. Exploitation of this issue does not require user interaction.

Affected Software

184 affected components

Adobe Commerce<2.4.9-alpha3

Adobe Commerce<2.4.4

Adobe Commerce=2.4.4

Adobe Commerce=2.4.4-p1

Adobe Commerce=2.4.4-p10

Adobe Commerce=2.4.4-p11

Adobe Commerce=2.4.4-p12

Adobe Commerce=2.4.4-p13

Adobe Commerce=2.4.4-p14

Adobe Commerce=2.4.4-p15

Adobe Commerce=2.4.4-p16

Adobe Commerce=2.4.4-p2

Adobe Commerce=2.4.4-p3

Adobe Commerce=2.4.4-p4

Adobe Commerce=2.4.4-p5

Adobe Commerce=2.4.4-p6

Adobe Commerce=2.4.4-p7

Adobe Commerce=2.4.4-p8

Adobe Commerce=2.4.4-p9

Adobe Commerce=2.4.5

Adobe Commerce=2.4.5-p1

Adobe Commerce=2.4.5-p10

Adobe Commerce=2.4.5-p11

Adobe Commerce=2.4.5-p12

Adobe Commerce=2.4.5-p13

Adobe Commerce=2.4.5-p14

Adobe Commerce=2.4.5-p15

Adobe Commerce=2.4.5-p2

Adobe Commerce=2.4.5-p3

Adobe Commerce=2.4.5-p4

Adobe Commerce=2.4.5-p5

Adobe Commerce=2.4.5-p6

Adobe Commerce=2.4.5-p7

Adobe Commerce=2.4.5-p8

Adobe Commerce=2.4.5-p9

Adobe Commerce=2.4.6

Adobe Commerce=2.4.6-p1

Adobe Commerce=2.4.6-p10

Adobe Commerce=2.4.6-p11

Adobe Commerce=2.4.6-p12

Adobe Commerce=2.4.6-p13

Adobe Commerce=2.4.6-p2

Adobe Commerce=2.4.6-p3

Adobe Commerce=2.4.6-p4

Adobe Commerce=2.4.6-p5

Adobe Commerce=2.4.6-p6

Adobe Commerce=2.4.6-p7

Adobe Commerce=2.4.6-p8

Adobe Commerce=2.4.6-p9

Adobe Commerce=2.4.7

Adobe Commerce=2.4.7-b1

Adobe Commerce=2.4.7-b2

Adobe Commerce=2.4.7-beta3

Adobe Commerce=2.4.7-p1

Adobe Commerce=2.4.7-p2

Adobe Commerce=2.4.7-p3

Adobe Commerce=2.4.7-p4

Adobe Commerce=2.4.7-p5

Adobe Commerce=2.4.7-p6

Adobe Commerce=2.4.7-p7

Adobe Commerce=2.4.7-p8

Adobe Commerce=2.4.8

Adobe Commerce=2.4.8-beta1

Adobe Commerce=2.4.8-beta2

Adobe Commerce=2.4.8-p1

Adobe Commerce=2.4.8-p2

Adobe Commerce=2.4.8-p3

Adobe Commerce=2.4.9-alpha1

Adobe Commerce=2.4.9-alpha2

Adobe Commerce=2.4.9-alpha3

Adobe Commerce B2b<1.3.3

Adobe Commerce B2b=1.3.3

Adobe Commerce B2b=1.3.3-p1

Adobe Commerce B2b=1.3.3-p10

Adobe Commerce B2b=1.3.3-p11

Adobe Commerce B2b=1.3.3-p12

Adobe Commerce B2b=1.3.3-p13

Adobe Commerce B2b=1.3.3-p14

Adobe Commerce B2b=1.3.3-p15

Adobe Commerce B2b=1.3.3-p16

Adobe Commerce B2b=1.3.3-p2

Adobe Commerce B2b=1.3.3-p3

Adobe Commerce B2b=1.3.3-p4

Adobe Commerce B2b=1.3.3-p5

Adobe Commerce B2b=1.3.3-p6

Adobe Commerce B2b=1.3.3-p7

Adobe Commerce B2b=1.3.3-p8

Adobe Commerce B2b=1.3.3-p9

Adobe Commerce B2b=1.3.4

Adobe Commerce B2b=1.3.4-p1

Adobe Commerce B2b=1.3.4-p10

Adobe Commerce B2b=1.3.4-p11

Adobe Commerce B2b=1.3.4-p12

Adobe Commerce B2b=1.3.4-p13

Adobe Commerce B2b=1.3.4-p14

Adobe Commerce B2b=1.3.4-p15

Adobe Commerce B2b=1.3.4-p2

Adobe Commerce B2b=1.3.4-p3

Adobe Commerce B2b=1.3.4-p4

Adobe Commerce B2b=1.3.4-p5

Adobe Commerce B2b=1.3.4-p6

Adobe Commerce B2b=1.3.4-p7

Adobe Commerce B2b=1.3.4-p8

Adobe Commerce B2b=1.3.4-p9

Adobe Commerce B2b=1.3.5

Adobe Commerce B2b=1.3.5-p1

Adobe Commerce B2b=1.3.5-p10

Adobe Commerce B2b=1.3.5-p11

Adobe Commerce B2b=1.3.5-p12

Adobe Commerce B2b=1.3.5-p13

Adobe Commerce B2b=1.3.5-p2

Adobe Commerce B2b=1.3.5-p3

Adobe Commerce B2b=1.3.5-p4

Adobe Commerce B2b=1.3.5-p5

Adobe Commerce B2b=1.3.5-p6

Adobe Commerce B2b=1.3.5-p7

Adobe Commerce B2b=1.3.5-p8

Adobe Commerce B2b=1.3.5-p9

Adobe Commerce B2b=1.4.2

Adobe Commerce B2b=1.4.2-p1

Adobe Commerce B2b=1.4.2-p2

Adobe Commerce B2b=1.4.2-p3

Adobe Commerce B2b=1.4.2-p4

Adobe Commerce B2b=1.4.2-p5

Adobe Commerce B2b=1.4.2-p6

Adobe Commerce B2b=1.4.2-p7

Adobe Commerce B2b=1.4.2-p8

Adobe Commerce B2b=1.5.2

Adobe Commerce B2b=1.5.2-p1

Adobe Commerce B2b=1.5.2-p2

Adobe Commerce B2b=1.5.2-p3

Adobe Commerce B2b=1.5.3-alpha1

Adobe Commerce B2b=1.5.3-alpha2

Adobe Commerce B2b=1.5.3-alpha3

Adobe Magento<2.4.5

Adobe Magento=2.4.5

Adobe Magento=2.4.5-p1

Adobe Magento=2.4.5-p10

Adobe Magento=2.4.5-p11

Adobe Magento=2.4.5-p12

Adobe Magento=2.4.5-p13

Adobe Magento=2.4.5-p14

Adobe Magento=2.4.5-p15

Adobe Magento=2.4.5-p2

Adobe Magento=2.4.5-p3

Adobe Magento=2.4.5-p4

Adobe Magento=2.4.5-p5

Adobe Magento=2.4.5-p6

Adobe Magento=2.4.5-p7

Adobe Magento=2.4.5-p8

Adobe Magento=2.4.5-p9

Adobe Magento=2.4.6

Adobe Magento=2.4.6-p1

Adobe Magento=2.4.6-p10

Adobe Magento=2.4.6-p11

Adobe Magento=2.4.6-p12

Adobe Magento=2.4.6-p13

Adobe Magento=2.4.6-p2

Adobe Magento=2.4.6-p3

Adobe Magento=2.4.6-p4

Adobe Magento=2.4.6-p5

Adobe Magento=2.4.6-p6

Adobe Magento=2.4.6-p7

Adobe Magento=2.4.6-p8

Adobe Magento=2.4.6-p9

Adobe Magento=2.4.7

Adobe Magento=2.4.7-b1

Adobe Magento=2.4.7-b2

Adobe Magento=2.4.7-beta3

Adobe Magento=2.4.7-p1

Adobe Magento=2.4.7-p2

Adobe Magento=2.4.7-p3

Adobe Magento=2.4.7-p4

Adobe Magento=2.4.7-p5

Adobe Magento=2.4.7-p6

Adobe Magento=2.4.7-p7

Adobe Magento=2.4.7-p8

Adobe Magento=2.4.8

Adobe Magento=2.4.8-beta1

Adobe Magento=2.4.8-beta2

Adobe Magento=2.4.8-p1

Adobe Magento=2.4.8-p2

Adobe Magento=2.4.8-p3

Adobe Magento=2.4.9-alpha3

Event History

Mar 10, 2026

CVE Published

12:00 AM

Data Sourced

12:00 AM

SeverityWeaknessAffected Software

Mar 11, 2026

CVE Published

via MITRE·02:19 AM

Data Sourced

via MITRE·02:19 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:15 AM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

APSB26-05

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2026-21293?

CVE-2026-21293 is classified as a high severity vulnerability due to its potential for security feature bypass.

How do I fix CVE-2026-21293?

To fix CVE-2026-21293, update Adobe Commerce to the latest version beyond 2.4.9-alpha3.

What systems are affected by CVE-2026-21293?

CVE-2026-21293 affects Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier.

What type of vulnerability is CVE-2026-21293?

CVE-2026-21293 is a Server-Side Request Forgery (SSRF) vulnerability.

What could be the consequences of exploiting CVE-2026-21293?

Exploiting CVE-2026-21293 could allow an attacker to bypass security features, leading to unauthorized access or information disclosure.

CVE-2026-21293: Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)

Affected Software

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-21293?

How do I fix CVE-2026-21293?

What systems are affected by CVE-2026-21293?

What type of vulnerability is CVE-2026-21293?

What could be the consequences of exploiting CVE-2026-21293?

Company

Resources

Contact