CVE-2026-21360: 
Adobe Commerce vulnerability analysis and mitigation

CVE-2026-21360 is a path traversal vulnerability (CWE-22) in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source that allows a high-privileged authenticated attacker to access unauthorized files or directories outside the intended restricted path, resulting in a security feature bypass. The vulnerability was disclosed on March 10–11, 2026, as part of Adobe's APSB26-05 security bulletin. Affected versions include Adobe Commerce 2.4.4 through 2.4.4-p16, 2.4.5 through 2.4.5-p15, 2.4.6 through 2.4.6-p13, 2.4.7 through 2.4.7-p8, 2.4.8 through 2.4.8-p3, and 2.4.9-alpha3, along with corresponding Commerce B2B and Magento Open Source releases. It carries a CVSS v3.1 base score of 6.8 (Medium) (Adobe Advisory).

The root cause is an Improper Limitation of a Pathname to a Restricted Directory (CWE-22), commonly known as path traversal. An attacker with high-level administrative privileges can craft requests that traverse outside the intended directory boundaries, bypassing file access restrictions enforced by the application. The attack is network-based, requires no user interaction, and has a changed scope, meaning the impact can extend beyond the vulnerable component itself. No public proof-of-concept or detailed technical write-up has been identified at this time (Adobe Advisory).

Successful exploitation allows a high-privileged attacker to read unauthorized files or directories on the server, resulting in a high confidentiality impact with no integrity or availability impact. The changed scope indicates that the attacker may be able to access resources beyond the Commerce application's own security domain, potentially exposing sensitive configuration files, credentials, or customer data stored on the underlying server. While the vulnerability does not directly enable code execution or data modification, unauthorized file access could facilitate further attacks such as credential harvesting or lateral movement (Adobe Advisory).

Adobe has released patched versions addressing CVE-2026-21360 as part of the APSB26-05 bulletin published March 10, 2026. Administrators should upgrade to the following fixed versions or later: Adobe Commerce 2.4.4-p17, 2.4.5-p16, 2.4.6-p14, 2.4.7-p9, 2.4.8-p4 (or 2.4.9 GA); corresponding Commerce B2B and Magento Open Source releases should also be updated per the advisory. As an interim measure, restrict administrative panel access to trusted IP addresses and enforce the principle of least privilege for admin accounts. Regularly audit admin user accounts and monitor for anomalous file access patterns (Adobe Advisory).

The CIS (Center for Internet Security) issued an advisory noting that multiple vulnerabilities in Adobe products, including this one, could allow for arbitrary code execution and security feature bypass, recommending prompt patching (CIS Advisory). Community aggregators such as CVEFeed and VulDB indexed the vulnerability shortly after disclosure, and it received routine coverage from security news outlets. No notable researcher commentary or significant social media discussion specific to CVE-2026-21360 has been identified beyond standard vulnerability tracking (Adobe Advisory).