EUVD-2026-74037
GHSA-w3wg-3rqw-c88m
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Network-reachable unauthenticated injection (PR:N/AV:N/AC:L) requiring victim page load (UI:R); scope-changed script executes in a privileged session (S:C, C:H/I:H), no availability impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
Articles & Coverage 1
AnalysisAI
Stored cross-site scripting in Adobe Commerce, Magento Open Source, and Adobe Commerce B2B (versions through the August 2026 builds of 2.4.4-2.4.9 / B2B 1.3.3-1.5.3) lets an attacker persist malicious JavaScript into vulnerable form fields that later executes in a victim's browser. Because the CVSS scope is changed, the injected script runs beyond the injection context and can hijack the victim's session or account, and CVSS:3.1 PR:N indicates the injection requires no attacker authentication while UI:R means a victim must load the affected page. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to reach and submit data into a specific vulnerable form field on an Adobe Commerce / Magento Open Source / Adobe Commerce B2B instance (network-reachable, no attacker authentication per CVSS PR:N), and - critically - a victim must subsequently browse to the page that renders the stored field (CVSS UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mixed: CVSS 9.3 is high and PR:N/AV:N/AC:L point to easy, network-reachable, unauthenticated injection, but UI:R meaningfully limits impact because a victim must visit the page containing the stored payload - this is not a fully automatable, wormable flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixed builds released in Adobe Security Bulletin APSB26-138 (https://helpx.adobe.com/security/products/magento/apsb26-138.html); Adobe distributes these as the corresponding security-patched releases/quality patches for the 2.4.x Commerce/Magento Open Source lines and the 1.x B2B line, so upgrade each affected instance to the vendor-designated patched version for its branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all systems running Adobe Commerce, Magento Open Source, or Adobe Commerce B2B at versions 2.4.4-2.4.9 (B2B 1.3.3-1.5.3) and restrict administrative access to affected form fields if technically feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary
SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Communit
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML E
Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.
An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which ca
An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Rated high severity (CVSS 8.1), th
Magento LTS is the official OpenMage LTS codebase. Rated high severity (CVSS 7.5), this vulnerability is remotely exploi
PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento
The fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterpri
Cross-site scripting (XSS) vulnerability in Magento E-Commerce Platform 1.9.0.1. Rated medium severity (CVSS 6.1), this
Password reset tokens in Magento CE before 1.9.2.2, and Magento EE before 1.14.2.2 are passed via a GET request and not
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication v
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today