What is the CVSS score of CVE-2026-47995?

CVE-2026-47995 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.7%.

Which versions of Adobe Commerce are affected by CVE-2026-47995?

Adobe Commerce, Commerce B2B, and Magento Open Source deployments are vulnerable to admin account compromise (CVE-2026-47995, CVSS 8.1) through persistent malicious code injected into form fields,…

How to fix or mitigate CVE-2026-47995?

Within 24 hours, inventory all Adobe Commerce, Commerce B2B, and Magento Open Source deployments and deploy web application firewall (WAF) rules to block common XSS payloads in form submissions. Within 7 days, implement strict input validation and output encoding on all form fields, enforce Content Security Policy (CSP) headers with restricted script-src directives, and review administrative access logs for suspicious activities. Within 30 days, monitor Adobe security bulletin APSB26-73 for patch availability, maintain a documented upgrade plan for when remediation is released, and consider implementing IP-based access restrictions for administrative panels to limit attack surface.

Adobe Commerce CVE-2026-47995

EUVD-2026-44417 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-14 adobe

GHSA-4g73-5xhh-82cv

XSS Adobe Adobe Commerce Magento Open Source Adobe Commerce B2B Adobe Commerce Webhooks Plugin

8.1

CVSS 3.1 · NVD

Severity by source

Vendor (adobe) PRIMARY

HIGH

qualitative

NVD

8.1 HIGH

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Stored XSS reachable over the network but requiring a high-privileged admin to inject (PR:H) and a victim to view the page (UI:R); scope changes across privilege boundary with high confidentiality/integrity impact and no availability effect.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (adobe).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Severity Changed

Jul 29, 2026 - 19:22 NVD

MEDIUM HIGH

CVSS changed

Jul 29, 2026 - 19:22 NVD

4.8 (MEDIUM) 8.1 (HIGH)

Severity Changed

Jul 15, 2026 - 14:37 NVD

HIGH MEDIUM

CVSS changed

Jul 15, 2026 - 14:37 NVD

8.1 (HIGH) 4.8 (MEDIUM)

Analysis Generated

Jul 14, 2026 - 20:58 vuln.today

CVE Published

Jul 14, 2026 - 19:44 nvd

HIGH 8.1

DescriptionNVD

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

AnalysisAI

Stored cross-site scripting in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin lets a high-privileged authenticated attacker persist malicious JavaScript in form fields that executes in a victim's browser when the affected page is viewed. Because CVSS scope is changed and the payload runs in the victim's authenticated context, an attacker can escalate to takeover of a higher-privileged admin session or account. No public exploit identified at time of analysis; remediated in Adobe security bulletin APSB26-73.

Technical ContextAI

Adobe Commerce (formerly Magento) is a widely deployed PHP-based e-commerce platform; this issue also spans the B2B extension, the open-source Magento core, and the Webhooks plugin, per the CPE data (cpe:2.3:a:adobe:adobe_commerce, adobe_commerce_b2b, magento_open_source, adobe_commerce_webhooks_plugin). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation) in the stored/persistent variant: attacker-supplied input placed in a form field is saved server-side without adequate output encoding or sanitization, then rendered verbatim to other users. In Magento-based platforms these fields are typically admin-panel entities (product, CMS, configuration, or webhook definitions) rendered back into the admin UI, which is why the CVSS vector reflects a scope change - script injected under one privilege boundary executes within the browser session of a different, potentially more privileged, admin user.

RemediationAI

Apply the fixes described in Adobe security bulletin APSB26-73 (https://helpx.adobe.com/security/products/magento/apsb26-73.html); the input did not include an exact fixed version number, so Patch available per vendor advisory - verify the precise patched build and any applicable quality patch (QPT) or hotfix for your version directly from that bulletin rather than assuming a version. As compensating controls until patched: tightly restrict which accounts hold the high-privilege admin roles required to write the vulnerable form fields (least-privilege review of admin ACLs), enable and enforce admin two-factor authentication to reduce risk of a privileged account being abused, and place the admin panel behind an IP allowlist or VPN and a WAF with XSS filtering to reduce exposure of the endpoints that render the injected content. Note trade-offs: WAF XSS rules can generate false positives against legitimate rich-text admin input, and IP allowlisting complicates remote administration - these reduce but do not eliminate the stored-XSS risk, so they are stopgaps, not substitutes for the vendor patch.