VYPR
← All advisories
Unrated severityNVD Advisory· Published Mar 11, 2026· Updated Mar 11, 2026

Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)

CVE-2026-21294

Description

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A high-privileged attacker could exploit this vulnerability to manipulate server-side requests and bypass security controls. Exploitation of this issue does not require user interaction.

Affected products

2
  • Adobe Inc./Commercellm-fuzzy2 versions
    <=2.4.4-p16, <=2.4.5-p15, <=2.4.6-p13, <=2.4.7-p8, <=2.4.8-p3, <=2.4.8-alpha3+ 1 more
    • (no CPE)range: <=2.4.4-p16, <=2.4.5-p15, <=2.4.6-p13, <=2.4.7-p8, <=2.4.8-p3, <=2.4.8-alpha3
    • (no CPE)range: 0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.