Adobe Commerce CVE-2026-48414

Requires an authenticated low-privileged account on the Adobe Commerce / Magento Open Source / Commerce B2B storefront or back office (PR:L) able to submit data into a vulnerable form field, plus victim interaction (UI:R) - a higher-privileged user such as an administrator must later browse the page that renders the stored payload. Exploitation is further limited by Adobe's stated dependence on 'conditions beyond the attacker's control,' and is bounded to affected releases: Adobe Commerce 2.4.4 through 2.4.9 (pre Aug-2026 patch), Magento Open Source 2.4.6-2.4.9 (pre Aug-2026 patch), and Commerce B2B 1.3.3-1.5.3 (pre Aug-2026 patch). It is not remote-unauthenticated and not automatable per SSVC.

Signals are consistent and point to a real-but-not-urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, base 8.7) reflects a network-reachable, low-complexity stored XSS that requires low-privileged authentication (PR:L) and victim interaction (UI:R), with a scope change (S:C) because injected script executes in another user's/admin's authenticated context. Corroborating signals temper the raw score: EPSS is low at 0.53% (42nd percentile), and CISA's SSVC decision framework lists Exploitation=none and Automatable=no, so no widespread or automated exploitation is expected - though it rates Technical Impact=total, aligning with the C:H/I:H account/session-takeover claim. There is no CISA KEV listing and no public exploit identified. The description's caveat 'Exploit depends on conditions beyond the attacker's control' suggests real-world exploitability is more constrained than AC:L alone implies (a case for AC:H); this is a mild internal tension between the NVD vector and Adobe's wording. Net: a legitimately dangerous stored XSS in a widely deployed e-commerce platform, but one gated by authentication, user interaction, and situational conditions - treat as important patch-management priority rather than an emergency.

A low-privileged authenticated user (e.g., a limited back-office/vendor or B2B company account) injects malicious JavaScript into a vulnerable form field that is later rendered to another user. When a higher-privileged victim such as a store administrator browses the page containing the stored payload, the script runs in their authenticated session, enabling account/session takeover across a security scope boundary. No public proof-of-concept exploit has been identified at time of analysis, and success depends on conditions beyond the attacker's control per Adobe's advisory.