CVE-2026-21295 LOW

CVE-2026-21295: Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)

Vendor Adobe
Product Adobe Commerce
Weakness CWE-601 · Open redirect
Published March 11, 2026
Last update March 11, 2026
View on NVD All CVEs

CVSS base score

3.1/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.

Key dates

02Disclosure timeline

March 11, 2026 CVE published
March 11, 2026 Record updated