What is the CVSS score of CVE-2026-34658?

CVE-2026-34658 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Commerce CVE-2026-34658

EUVD-2026-29766 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-12 adobe

GHSA-5mxp-wm76-rf59

XSS Adobe Adobe Commerce

4.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

4.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

4.8 MEDIUM

PR:H reflects mandatory high-privilege write access to inject the payload; S:C and C:L/I:L capture session-context impact in the victim's browser with no server availability effect.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:34 vuln.today

CVE Published

May 12, 2026 - 19:50 nvd

MEDIUM 4.8

DescriptionCVE.org

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Commerce allows a high-privileged attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in any victim's browser upon visiting the affected page. All active release trains from 2.4.4 through 2.4.8 are affected, along with the 2.4.9-beta1 pre-release. No public exploit identified at time of analysis; an EPSS score of 0.02% (5th percentile) and SSVC exploitation status of 'none' confirm negligible current exploitation activity, keeping real-world urgency low despite the stored nature of the flaw.

Technical ContextAI

Adobe Commerce (formerly Magento) is a widely-deployed PHP-based e-commerce platform. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), specifically the stored variant, meaning attacker-controlled input is persisted to the application's database and subsequently rendered unsanitized to other users' browsers without adequate output encoding. The CPE string cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:* confirms broad applicability across the Commerce product line. The CVSS vector metric S:C (Scope Changed) is significant: it reflects that the injected script executes in the security context of the victim's browser - a separate principal from the application server - enabling cross-context attacks such as session hijacking or admin action forgery even though the payload originates from the application backend.

RemediationAI

Patch available per vendor advisory APSB26-49 (https://helpx.adobe.com/security/products/magento/apsb26-49.html); consult this advisory for exact fixed versions in each patch train, as the input data confirms affected versions but does not enumerate the specific successor patch releases. Administrators should apply the latest patch for their respective release line (2.4.4, 2.4.5, 2.4.6, 2.4.7, or 2.4.8 series) immediately. As an interim compensating control, organizations should audit and restrict which accounts hold high-privilege roles in the Commerce admin panel - reducing the attacker pool directly limits exploitability given the PR:H requirement. Content Security Policy (CSP) headers configured to block inline script execution can reduce the impact of any injected payload, though they do not eliminate the underlying vulnerability. Review and sanitize stored admin-editable rich-text and form fields as a supplementary hardening measure.