What is the CVSS score of CVE-2026-47999?

CVE-2026-47999 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 11.5%.

Adobe Commerce CVE-2026-47999

EUVD-2026-44422 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-14 adobe

GHSA-m6hw-4f76-6fwg

XSS Adobe Adobe Commerce Adobe Commerce B2B Magento Open Source Adobe Commerce Webhooks Plugin

4.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

4.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

4.8 MEDIUM

PR:H reflects mandatory high-privilege admin access to inject; UI:R for victim browse; S:C captures browser-context escape; no availability impact applies.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 14:40 vuln.today

CVE Published

Jul 14, 2026 - 19:44 cve.org

MEDIUM 4.8

DescriptionCVE.org

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin allows a high-privileged attacker to inject persistent malicious JavaScript into vulnerable admin form fields, which then executes in any victim's browser that navigates to the affected page. Scope change (S:C) is confirmed in the CVSS vector, meaning the injected payload crosses from the Commerce application security boundary into the victim's browser session, enabling session hijacking or credential harvesting. Despite no current KEV listing, the EPSS score sits at the 96th percentile (11.52%), warranting close monitoring even though CISA SSVC currently rates exploitation as none and the attack is not assessed as automatable.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause - the application fails to sanitize attacker-controlled input before persisting it server-side and later reflecting it into rendered HTML pages. Because the payload is stored rather than reflected, it does not require the attacker to trick the victim into clicking a crafted link; any user visiting the poisoned page triggers execution. The CVSS S:C metric confirms the security scope of the injected script extends beyond the origin application into the victim's browser context. CPE data identifies four distinct affected product families: cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*, cpe:2.3:a:adobe:adobe_commerce_b2b:*:*:*:*:*:*:*:*, cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*, and cpe:2.3:a:adobe:adobe_commerce_webhooks_plugin:*:*:*:*:*:*:*:*, indicating the vulnerability surface spans the core platform, its B2B extension, the open-source fork, and a separately installable webhook integration plugin.

RemediationAI

Apply the July 2026 security patches per Adobe Security Bulletin APSB26-73 (https://helpx.adobe.com/security/products/magento/apsb26-73.html). Adobe Commerce should be updated to the July 2026 patch release corresponding to the installed branch: 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, or 2.4.4-2026-jul. Adobe Commerce B2B should be updated to 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, or 1.3.3-2026-jul as applicable. Magento Open Source should be updated to 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, or 2.4.6-2026-jul. The Adobe Commerce Webhooks Plugin should be updated to version 1.21.0. As compensating controls pending patch deployment, restrict admin-panel access to known trusted IP ranges at the network perimeter to reduce the pool of accounts that could inject payloads - note this does not protect against already-compromised admin accounts within those ranges. Deploying a strict Content Security Policy (CSP) on Commerce pages can reduce XSS payload impact (e.g., blocking exfiltration to external domains), but Adobe Commerce customizations frequently require inline scripts, so CSP must be validated carefully against existing themes and extensions before enforcement.