What is the CVSS score of CVE-2026-34655?

CVE-2026-34655 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Adobe Commerce CVE-2026-34655

EUVD-2026-29764 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-12 adobe

GHSA-6r2f-m253-63j6

Adobe XSS Adobe Commerce

4.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

4.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

4.8 MEDIUM

Network delivery via admin web interface, high privileges required to store payload, victim interaction required, scope changes to victim browser; no availability impact.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:39 vuln.today

CVE Published

May 12, 2026 - 19:50 nvd

MEDIUM 4.8

DescriptionCVE.org

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Commerce 2.4.x allows a high-privileged attacker to inject persistent JavaScript payloads into vulnerable form fields, which execute in the browser of any user who subsequently views the affected page. The scope change (S:C) means injected scripts run in the victim's browser security context, enabling session hijacking or unauthorized action execution against lower-privileged users. No public exploit code has been identified and EPSS at 0.06% (20th percentile) with SSVC exploitation status of 'none' confirm no current active exploitation.

Technical ContextAI

Adobe Commerce (formerly Magento) is a PHP-based enterprise e-commerce platform identified by CPE cpe:2.3:a:adobe:adobe_commerce. The vulnerability class is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored/persistent variant: attacker-supplied input is written to the database and later rendered in a victim's browser without adequate output encoding or sanitization. The CVSS scope change metric (S:C) is technically significant - it confirms that the injected script executes in a security context distinct from the attacker's own session, meaning impact crosses a trust boundary from the admin panel to other users' browser sessions. The network attack vector (AV:N) and low complexity (AC:L) reflect delivery via standard HTTP through the web-accessible admin interface, requiring no special network positioning.

RemediationAI

Apply the fixes detailed in Adobe Security Bulletin APSB26-49 at https://helpx.adobe.com/security/products/magento/apsb26-49.html, which is the authoritative source for confirmed patched versions across all affected branches. Exact successor patch versions (e.g., the release following 2.4.8-p4) are not independently confirmed from the available input data and must be verified directly against APSB26-49 before deployment. As a compensating control pending patching, enforce multi-factor authentication on all Commerce admin accounts to reduce the risk of admin credential compromise, which is the prerequisite for exploitation. Restrict admin panel access by IP allowlist where operationally feasible, and audit existing admin user accounts for unauthorized entries. Note that IP restriction mitigates external attacker access but does not protect against a malicious insider who already holds admin credentials.