Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a security feature bypass. A high-privileged attacker could exploit this vulnerability to manipulate server-side requests and access unauthorized resources. Exploitation does not require user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.5 | CVE-2026-21293 |
Exploitation
To exploit this vulnerability, an attacker with high privileges can craft specific server-side requests that manipulate the server’s behavior. By doing so, they can access unauthorized resources without needing any user interaction, making it a significant risk for systems running the affected versions.
Affected Products
- Adobe Commerce 2.4.9-alpha3
- Adobe Commerce 2.4.8-p3
- Adobe Commerce 2.4.7-p8
- Adobe Commerce 2.4.6-p13
- Adobe Commerce 2.4.5-p15
- Adobe Commerce 2.4.4-p16 and earlier
Mitigation
To mitigate this vulnerability, it is recommended that users upgrade to the latest version of Adobe Commerce that addresses this SSRF issue. Regularly applying security patches and monitoring for unusual server activity can also help reduce the risk of exploitation.