CVE-2026-21295

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.

Score

CVSS 3.1 3.1 Low

Status

Analyzed - psirt@adobe.com

Published

2026-03-11

Last modified

2026-08-27

Weaknesses

CWE-601

Affected products

• Adobe Commerce (Adobe)
• Adobe Commerce B2b (Adobe)
• Commerce (Adobe)
• Commerce B2b (Adobe)
• Magento (Adobe)
• Magento Open Source (Adobe)

References

• https://helpx.adobe.com/security/products/magento/apsb26-05.html