Adobe Commerce CVE-2026-47999

Exploitation requires possession of a high-privileged Adobe Commerce, Magento Open Source, or B2B admin account (PR:H per CVSS vector) with write access to the specific vulnerable form field(s). A second user must then actively browse to the page containing the injected content (UI:R), meaning the attack is not fire-and-forget against anonymous users. For the Adobe Commerce Webhooks Plugin attack surface specifically, that plugin must be installed and the attacker must have access to its configuration interface. Exploitation is limited by: the requirement for a high-privilege account to inject the payload (substantially raising the bar above typical web vulnerabilities), the need for a victim to navigate to the affected page, and the fact that the attack is not automatable per SSVC assessment. The scope change means a single injection can affect multiple victim sessions over time without re-injection.

The CVSS base score of 4.8 (Medium) is primarily suppressed by PR:H (high privilege required to inject the payload) and UI:R (victim must navigate to the affected page). These two mitigating factors make automated, mass exploitation implausible - confirmed by SSVC rating the attack as non-automatable with partial technical impact. However, the EPSS score of 11.52% at the 96th percentile is a notable outlier: the model's exploitation probability is significantly higher than for nearly all other CVEs, suggesting the broader threat intelligence community may be anticipating exploitation interest in Adobe Commerce targets. This divergence from SSVC:none should not be dismissed - it may reflect the large merchant base, the value of Commerce admin sessions to fraud actors, or the broad version range affected. The absence of a KEV listing means active exploitation has not been confirmed by CISA at time of analysis. Real-world risk is elevated for environments where admin credentials may be shared, reused, or phished, as a compromised high-privileged account is the required prerequisite for injection.

An attacker who has obtained or compromised a high-privileged Adobe Commerce administrator account navigates to a vulnerable admin form field - such as a product description, CMS block, or webhook configuration field - and injects a persistent JavaScript payload (e.g., a script that exfiltrates document.cookie to an attacker-controlled endpoint). When a legitimate administrator or privileged user later browses to the page rendering that field, the stored script executes silently in their browser, stealing session tokens that can be replayed to hijack the victim's authenticated session. No public exploit code has been identified at time of analysis, but the scope of the injected payload crossing into the victim's browser context (S:C) makes session takeover a realistic primary impact.