CVE-2026-21295
Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
At a glance Severity LOW 3.1 EPSS EPSS 0.24 % · percentile 15 (2026-10-27) State PUBLISHED Published 2026-03-11 Updated 2026-08-27 Assigner adobe NVD status Analyzed Description Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
Scores Version Score Vector Scored by CVSS 3.1 LOW 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N adobe CVSS 3.1 LOW 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N NVD · psirt@adobe.com (Secondary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:* < 2.4.4cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p10:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p11:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p12:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p13:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p14:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p15:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p16:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p7:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p8:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p9:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p10:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p11:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p12:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p13:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p14:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p15:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p3:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p4:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p5:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p6:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p7:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p8:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p9:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.6:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.6:p1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.6:p10:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.6:p11:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.6:p12:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.6:p13:*:*:*:*:*:*+143 more Affected products Product Versions Adobe · Adobe Commerce affected 0 ≤ 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 ; unaffected 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 Adobe · Adobe Commerce B2B affected 0 ≤ 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 ; unaffected 1.5.3-beta1, 1.5.2-p4, 1.4.2-p9, 1.3.5-p14, 1.3.4-p16, 1.3.3-p17 Adobe · Magento Open Source affected 0 ≤ 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15 ; unaffected 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16
References
Sources
