Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a security feature bypass. A high-privileged attacker could exploit this vulnerability to manipulate server-side requests and bypass security controls. Exploitation does not require user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.5 | CVE-2026-21294 |
Exploitation
To exploit this vulnerability, an attacker with high privileges can craft specific server-side requests that manipulate the server’s behavior. By doing so, they can bypass security controls in place, allowing unauthorized access to sensitive information or functionalities. This can be achieved without any user interaction, making it particularly dangerous.
Affected Products
- Adobe Commerce 2.4.9-alpha3
- Adobe Commerce 2.4.8-p3
- Adobe Commerce 2.4.7-p8
- Adobe Commerce 2.4.6-p13
- Adobe Commerce 2.4.5-p15
- Adobe Commerce 2.4.4-p16
- Earlier versions
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of Adobe Commerce that addresses the SSRF issue. Additionally, implementing strict access controls and monitoring server-side requests can help reduce the risk of exploitation.