Adobe Commerce CVE-2026-47995

Exploitation requires the attacker to already possess a high-privileged Adobe Commerce/Magento admin account (CVSS PR:H) with the ability to write to a persistent form field, and it requires a victim to subsequently browse to the page that renders that stored field (CVSS UI:R). The concrete prerequisite is authenticated write access to a stored/persisted form field in the admin context plus a second user viewing the affected page. Limiting factors that reduce realistic risk: the mandatory high privilege level restricts this to insiders or already-compromised privileged accounts, and the required victim interaction means the payload does not fire autonomously. No specific non-default configuration is named in the description beyond deployment of the affected products/plugin; the changed scope indicates the injected script executes across a privilege boundary into the victim's session.

The CVSS 3.1 base score is 8.1 (High) with vector AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N - network-reachable and low complexity, but gated by two meaningful limiters: PR:H (the attacker must already hold high privileges) and UI:R (a victim must load the poisoned page). The changed scope plus C:H/I:H drives the score upward, reflecting cross-boundary session/account compromise. No EPSS score, KEV listing, or POC was provided, so exploitation probability signals are absent; treat as no public exploit identified at time of analysis. Realistically this is a privilege-escalation/insider or post-compromise vector rather than a mass-exploitable external threat: the PR:H requirement sharply narrows the attacker population, so despite the High CVSS this is a lower real-world priority than an unauthenticated RCE. SSVC-style read: exploitation is unreported, automatable is unlikely (requires privileged access plus victim interaction), and technical impact is total within the affected session - a genuine but conditional risk. No conflicting signals between the vector and the description were observed.

A malicious or compromised sub-admin with content or configuration privileges injects a JavaScript payload into a stored form field (for example a product, CMS block, or webhook definition). When a higher-privileged administrator later opens the page that renders that field, the script executes in their authenticated session and can hijack their session token or perform actions as that admin. No public proof-of-concept was provided; low attack complexity (AC:L) makes reliable exploitation straightforward once the privileged access and victim page-view conditions are met.