PT-2026-24552 · Adobe · Commerce

Michele Damico · Published 2026-03-10 · Updated 2026-03-11 · CVE-2026-21286

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.4 through 2.4.9-alpha3

Description Adobe Commerce is affected by an Incorrect Authorization issue that may allow a security feature bypass. An attacker could exploit this to gain limited unauthorized view access to data without requiring user interaction.

Recommendations Adobe Commerce versions prior to 2.4.4 should be updated. Adobe Commerce version 2.4.4-p16 should be updated. Adobe Commerce version 2.4.5-p15 should be updated. Adobe Commerce version 2.4.6-p13 should be updated. Adobe Commerce version 2.4.7-p8 should be updated. Adobe Commerce version 2.4.8-p3 should be updated. Adobe Commerce version 2.4.9-alpha3 should be updated.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2026-03221

CVE-2026-21286

Affected Products

Commerce

References · 9

• https://bdu.fstec.ru/vul/2026-03221 · Security Note
• https://helpx.adobe.com/security/products/magento/apsb26-05.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-21286 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21286 · Security Note
• https://twitter.com/CVEnew/status/2031597254256300316 · Twitter Post
• https://twitter.com/cyberbivash/status/2031598825295507680 · Twitter Post
• https://t.me/CVEtracker/47067 · Telegram Post
• https://t.me/cveNotify/155142 · Telegram Post
• https://t.me/cveNotify/155031 · Telegram Post