What is the CVSS score of CVE-2026-34686?

CVE-2026-34686 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Adobe Commerce are affected by CVE-2026-34686?

Adobe Commerce (Magento) contains a stored cross-site scripting vulnerability allowing low-privileged authenticated users to inject malicious code into form fields that executes in the browsers of…

How to fix or mitigate CVE-2026-34686?

Within 24 hours: audit all accessible form fields in Adobe Commerce instances to identify which lack adequate output encoding, and document the scope of affected functions and user roles. Within 7 days: deploy Web Application Firewall rules to detect and block JavaScript patterns in form submissions; restrict access to high-risk form fields to trusted administrative users only; implement Content Security Policy headers to prevent inline script execution. Within 30 days: maintain active communication with Adobe for patch availability; deploy any released patches immediately upon vendor release; implement mandatory output encoding on all form field displays as permanent defense-in-depth hardening.

Adobe Commerce CVE-2026-34686

EUVD-2026-29781 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-12 adobe

GHSA-9wrj-m77q-jw6c

Adobe XSS Adobe Commerce

8.7

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

Authenticated low-priv attacker (PR:L) injects stored script executed only after a victim views the page (UI:R); scope change (S:C) reflects cross-privilege session takeover with high C/I and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:35 vuln.today

CVE Published

May 12, 2026 - 19:50 nvd

HIGH 8.7

DescriptionCVE.org

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

AnalysisAI

Stored cross-site scripting in Adobe Commerce (Magento) lets a low-privileged authenticated user persist malicious JavaScript into vulnerable form fields, which then executes in the browser of any victim who later views the affected page. Because scope is changed, the injected script can escalate to takeover of the victim's account or session, including higher-privileged admin sessions. No public exploit identified at time of analysis, and EPSS is negligible (0.01%, 2nd percentile), indicating low near-term mass-exploitation likelihood.

Technical ContextAI

Adobe Commerce is Adobe's enterprise e-commerce platform (formerly Magento), a PHP application serving both a customer storefront and a privileged admin panel. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): user-supplied data submitted through a form field is stored server-side and later rendered into an HTML page without adequate output encoding or sanitization, so attacker-controlled markup is interpreted as executable script. The stored (persistent) nature means the payload is served to every user who loads the affected page, and the CVSS scope-change flag indicates the executed script crosses a trust boundary - a payload injected by a low-privileged account can run in the context of a more privileged victim (e.g., an administrator's authenticated session). CPE cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:* confirms the affected product is the Adobe Commerce application itself across the listed release trains.

RemediationAI

Patch available per vendor advisory: apply the fixed releases published in Adobe Security Bulletin APSB26-49 (https://helpx.adobe.com/security/products/magento/apsb26-49.html) that supersede the affected 2.4.4-p17 / 2.4.5-p16 / 2.4.6-p14 / 2.4.7-p9 / 2.4.8-p4 / 2.4.9-beta1 lines - upgrade to the corresponding patched version for your branch (exact fixed build not enumerated in the provided data, so confirm the target version in the advisory before deploying). As compensating controls until patched, restrict who can create the low-privileged accounts able to submit stored form content and tighten input validation/WAF rules to strip or encode script tags on the affected form fields, accepting that overly aggressive WAF signatures may reject legitimate rich content; additionally enforce a restrictive Content-Security-Policy that disallows inline script execution to blunt payload execution, noting this can break themes or extensions relying on inline JavaScript. Because exploitation requires an admin/victim to view the injected page, also limit exposure of admin review workflows to untrusted submissions.