What is the CVSS score of CVE-2026-47994?

CVE-2026-47994 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.9%.

Which versions of Adobe Commerce are affected by CVE-2026-47994?

Attackers with low-privilege access to Adobe Commerce and Magento platforms can inject malicious code that hijacks customer and administrative accounts, exposing transaction data and operational…

How to fix or mitigate CVE-2026-47994?

Within 24 hours: inventory all instances running affected Adobe Commerce and Magento versions; review access logs and form submissions for indicators of stored XSS injection; temporarily restrict low-privilege user access to sensitive form fields if business operations permit. Within 7 days: deploy web application firewall (WAF) rules configured to detect and block stored XSS patterns; implement Content-Security-Policy and X-XSS-Protection HTTP headers; conduct input validation and output encoding audit across all user-editable form fields. Within 30 days: establish continuous monitoring for Adobe security advisories and patch releases; develop and test an upgrade plan for all affected systems; conduct security awareness training for administrators focused on XSS attack signatures and detection methods.

Adobe Commerce CVE-2026-47994

EUVD-2026-44413 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-14 adobe

GHSA-43w8-p43r-wq5q

XSS Adobe Adobe Commerce Adobe Commerce B2B Magento Open Source Adobe Commerce Webhooks Plugin

8.7

CVSS 3.1 · NVD

Severity by source

Vendor (adobe) PRIMARY

HIGH

qualitative

NVD

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

Network-reachable form field with low complexity, requiring a low-privileged account (PR:L) and victim interaction (UI:R); stored XSS crosses into a higher-privileged session (S:C) enabling session and account compromise (C:H/I:H) with no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (adobe).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Severity Changed

Jul 29, 2026 - 19:22 NVD

MEDIUM HIGH

CVSS changed

Jul 29, 2026 - 19:22 NVD

5.4 (MEDIUM) 8.7 (HIGH)

Severity Changed

Jul 15, 2026 - 15:37 NVD

HIGH MEDIUM

CVSS changed

Jul 15, 2026 - 15:37 NVD

8.7 (HIGH) 5.4 (MEDIUM)

Analysis Generated

Jul 14, 2026 - 20:59 vuln.today

CVE Published

Jul 14, 2026 - 19:44 nvd

HIGH 8.7

DescriptionNVD

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

AnalysisAI

Stored cross-site scripting in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source lets a low-privileged authenticated attacker persist malicious JavaScript into vulnerable form fields, which then executes in a victim's browser and can escalate to account or session takeover. Because scope is changed (S:C), the injected script runs in a security context beyond the attacker's own privileges - the hallmark of admin-panel or storefront XSS crossing a trust boundary. No public exploit identified at time of analysis, but the 8.7 CVSS and account-takeover impact make this a meaningful priority for e-commerce operators running the affected platforms.

Technical ContextAI

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation) in its stored/persistent form, where user-supplied data written into form fields is later rendered without adequate contextual output encoding or sanitization. Affected products per the CPE data are cpe:2.3:a:adobe:adobe_commerce, adobe_commerce_b2b, magento_open_source, and adobe_commerce_webhooks_plugin - all part of Adobe's Magento-derived PHP stack using PHTML/Knockout.js templating, which exposes many back-office and B2B form fields that feed admin- and customer-facing pages. Insufficient escaping in one such rendering path lets attacker-controlled markup be stored and replayed, and the changed scope indicates the payload fires in a different (higher-privileged) session than the account that injected it.

RemediationAI

Apply the security update described in Adobe bulletin APSB26-73 (https://helpx.adobe.com/security/products/magento/apsb26-73.html) - Patch available per vendor advisory; the exact fixed versions for Adobe Commerce, Commerce B2B, Magento Open Source, and the Webhooks Plugin are enumerated there and should be applied through your deployment channel rather than an invented version number. Where immediate patching is not possible, apply specific compensating controls: tighten and audit which low-privileged accounts can submit the affected form fields (trade-off: operational friction), deploy a strict Content-Security-Policy to block inline script execution in the admin and storefront (trade-off: may break legitimate inline scripts and needs tuning), and front the admin panel with IP allowlisting or a WAF carrying XSS rules on the affected parameters (trade-off: possible false positives on legitimate rich content). Additionally, audit existing stored field values for previously injected markup both before and after patching.