Adobe Commerce CVE-2026-76200

Exploitation requires the attacker to reach and submit data into a specific vulnerable form field on an Adobe Commerce / Magento Open Source / Adobe Commerce B2B instance (network-reachable, no attacker authentication per CVSS PR:N), and - critically - a victim must subsequently browse to the page that renders the stored field (CVSS UI:R). The limiting factors are this required victim interaction and the need for the target to run an unpatched build at or below the listed 2026-aug versions; impact is highest when the victim is a privileged admin, which the scope-changed vector reflects.

The signals are mixed: CVSS 9.3 is high and PR:N/AV:N/AC:L point to easy, network-reachable, unauthenticated injection, but UI:R meaningfully limits impact because a victim must visit the page containing the stored payload - this is not a fully automatable, wormable flaw. There is no EPSS score, no CISA KEV listing, and no known public POC in the provided data, so there is no evidence of active exploitation; the 9.3 is driven largely by the scope change plus C:H/I:H (session/account compromise) rather than by demonstrated real-world weaponization. Adobe Commerce is a high-value, internet-facing e-commerce target where admin-session XSS can escalate to store compromise and payment/customer-data exposure, so patching should be prioritized even absent exploitation evidence; a mid-sized retail operator with a public storefront should treat this as urgent given the low attack complexity, while acknowledging the UI:R gate as a mitigating factor.

An attacker submits a form field (e.g., a customer- or content-facing input) containing a crafted JavaScript payload, which the platform stores. When a store administrator or another user later opens the page rendering that field, the script executes in their authenticated session and exfiltrates session tokens or performs actions as that user, enabling account or session takeover. No public exploit code is identified at time of analysis, and success depends on a victim loading the affected page (UI:R).