UpHeron
All vulnerabilities

Servers and applications

CVE-2026-21359

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and have limited impact to the integrity and availability of data. The exploit depends on conditions beyond the…

Severity
Medium 4.7
Published
11 Mar 2026
Last changed
28 Aug 2026
Added to UpHeron
21 Oct 2026
Fixed in
2.4.4, 2.4.5
Sources
NVD

Affected software

SoftwareAffected versions
Magento / Adobe CommerceServers and applications · cpe:a:adobe:commerce
  • Version 2.4.9-alpha3
  • Version 2.4.9-alpha2
  • Version 2.4.9-alpha1
  • Version 2.4.8-p3
All 69 release lines
  • Every version before 2.4.4
  • Version 2.4.4
  • Version 2.4.4-p1
  • Version 2.4.4-p2
  • Version 2.4.4-p3
  • Version 2.4.4-p4
  • Version 2.4.4-p5
  • Version 2.4.4-p6
  • Version 2.4.4-p7
  • Version 2.4.4-p8
  • Version 2.4.4-p9
  • Version 2.4.4-p10
  • Version 2.4.4-p11
  • Version 2.4.4-p12
  • Version 2.4.4-p13
  • Version 2.4.4-p14
  • Version 2.4.4-p15
  • Version 2.4.4-p16
  • Version 2.4.5
  • Version 2.4.5-p1
  • Version 2.4.5-p2
  • Version 2.4.5-p3
  • Version 2.4.5-p4
  • Version 2.4.5-p5
  • Version 2.4.5-p6
  • Version 2.4.5-p7
  • Version 2.4.5-p8
  • Version 2.4.5-p9
  • Version 2.4.5-p10
  • Version 2.4.5-p11
  • Version 2.4.5-p12
  • Version 2.4.5-p13
  • Version 2.4.5-p14
  • Version 2.4.5-p15
  • Version 2.4.6
  • Version 2.4.6-p1
  • Version 2.4.6-p2
  • Version 2.4.6-p3
  • Version 2.4.6-p4
  • Version 2.4.6-p5
  • Version 2.4.6-p6
  • Version 2.4.6-p7
  • Version 2.4.6-p8
  • Version 2.4.6-p9
  • Version 2.4.6-p10
  • Version 2.4.6-p11
  • Version 2.4.6-p12
  • Version 2.4.6-p13
  • Version 2.4.7-b1
  • Version 2.4.7-b2
  • Version 2.4.7-beta3
  • Version 2.4.7
  • Version 2.4.7-p1
  • Version 2.4.7-p2
  • Version 2.4.7-p3
  • Version 2.4.7-p4
  • Version 2.4.7-p5
  • Version 2.4.7-p6
  • Version 2.4.7-p7
  • Version 2.4.7-p8
  • Version 2.4.8-beta1
  • Version 2.4.8-beta2
  • Version 2.4.8
  • Version 2.4.8-p1
  • Version 2.4.8-p2
  • Version 2.4.8-p3
  • Version 2.4.9-alpha1
  • Version 2.4.9-alpha2
  • Version 2.4.9-alpha3
Magento / Adobe CommerceServers and applications · cpe:a:adobe:magento
  • Version 2.4.9-alpha3
  • Version 2.4.8-p3
  • Version 2.4.8-p2
  • Version 2.4.8-p1
All 50 release lines
  • Every version before 2.4.5
  • Version 2.4.5
  • Version 2.4.5-p1
  • Version 2.4.5-p2
  • Version 2.4.5-p3
  • Version 2.4.5-p4
  • Version 2.4.5-p5
  • Version 2.4.5-p6
  • Version 2.4.5-p7
  • Version 2.4.5-p8
  • Version 2.4.5-p9
  • Version 2.4.5-p10
  • Version 2.4.5-p11
  • Version 2.4.5-p12
  • Version 2.4.5-p13
  • Version 2.4.5-p14
  • Version 2.4.5-p15
  • Version 2.4.6
  • Version 2.4.6-p1
  • Version 2.4.6-p2
  • Version 2.4.6-p3
  • Version 2.4.6-p4
  • Version 2.4.6-p5
  • Version 2.4.6-p6
  • Version 2.4.6-p7
  • Version 2.4.6-p8
  • Version 2.4.6-p9
  • Version 2.4.6-p10
  • Version 2.4.6-p11
  • Version 2.4.6-p12
  • Version 2.4.6-p13
  • Version 2.4.7-b1
  • Version 2.4.7-b2
  • Version 2.4.7-beta3
  • Version 2.4.7
  • Version 2.4.7-p1
  • Version 2.4.7-p2
  • Version 2.4.7-p3
  • Version 2.4.7-p4
  • Version 2.4.7-p5
  • Version 2.4.7-p6
  • Version 2.4.7-p7
  • Version 2.4.7-p8
  • Version 2.4.8-beta1
  • Version 2.4.8-beta2
  • Version 2.4.8
  • Version 2.4.8-p1
  • Version 2.4.8-p2
  • Version 2.4.8-p3
  • Version 2.4.9-alpha3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-21359
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-21359