Input validation error in Adobe products - CVE-2026-21310

Vulnerability identifier: #VU123811

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-21310

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted input to the application and bypass implemented security restrictions.

Adobe Commerce B2B
Magento Open Source
Adobe Commerce (formerly Magento Commerce)

Install updates from vendor's website.

Adobe Commerce B2B - addressed in versions 1.3.3‑p17, 1.3.4-p16, 1.3.5‑p14, 1.4.2‑p9, 1.5.2-p4, 1.5.3 beta1
Magento Open Source - addressed in versions 2.4.5‑p16, 2.4.6-p14, 2.4.7-p9, 2.4.8-p4, 2.4.9‑beta1
Adobe Commerce (formerly Magento Commerce) - addressed in versions 2.4.4‑p17, 2.4.5‑p16, 2.4.6‑p14, 2.4.7‑p9, 2.4.8‑p4, 2.4.9‑beta1

• https://helpx.adobe.com/security/products/magento/apsb26-05.html

• Multiple vulnerabilities in Adobe Commerce and Magento Open Source