EUVD-2026-74036
GHSA-3vvf-3c6r-r3hc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify vulnerable form field
-
DeliverySubmit stored XSS payload
-
ExploitPayload persisted server-side
-
ExecutionAdmin/victim views page
-
PersistScript executes in victim browser
-
ImpactSession/account takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to reach a specific vulnerable form field in Adobe Commerce / Magento Open Source / Commerce B2B and store a JavaScript payload there (per CVSS PR:N, no authentication is required to inject), and it requires a victim to subsequently browse to the page that renders the stored field (UI:R). Limiting factors: the attack is not automatic - it depends on a victim (likely a higher-privilege admin, given the S:C scope change) viewing the poisoned page; it is constrained to the specific form field(s) Adobe identifies as vulnerable; and only the affected version trains (Commerce 2.4.4-2.4.9, Open Source 2.4.6-2.4.9, B2B 1.3.3-1.5.3 and their 2026-aug builds) are exposed. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, 9.3) describes network-reachable, low-complexity, unauthenticated injection requiring victim interaction (browsing to the poisoned page), with high confidentiality and integrity impact and a scope change - a realistic profile for stored XSS leading to admin/account takeover. The PR:N rating implies the injection point is reachable without authentication, which fits a public form field; defenders should confirm which specific field is affected, since some Magento form fields are admin-only (which would effectively raise the barrier). No EPSS score, KEV entry, or POC is provided, so there is no evidence of active exploitation or public exploit code - the high score reflects potential impact, not confirmed in-the-wild abuse. Adobe e-commerce is a high-value, internet-facing target historically subject to rapid exploitation once details emerge, so patching should be prioritized despite the absence of a current POC. |
| Exploit ScenarioDerived | An attacker submits a crafted payload containing malicious JavaScript into a vulnerable Adobe Commerce form field (for example a customer-supplied field later reviewed in the merchant admin). When a store administrator or another victim opens the page displaying that stored value, the script runs in their browser and can steal session cookies or perform actions as that user, enabling account or session takeover. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
Stored cross-site scripting in Adobe Commerce, Magento Open Source, and Adobe Commerce B2B lets a remote attacker persist malicious JavaScript in vulnerable form fields that later executes in a victim's browser when they view the affected page. Successful exploitation can hijack the victim's session or account, and because scope is changed (S:C) the payload can affect resources beyond the vulnerable component - for example an admin session viewing attacker-supplied content. Adobe PSIRT rates it 9.3 Critical; no public exploit identified at time of analysis and it is not in CISA KEV.
RemediationAI
Apply the security update referenced in Adobe advisory APSB26-138 (https://helpx.adobe.com/security/products/magento/apsb26-138.html); the input lists the affected trains as Adobe Commerce/Magento Open Source 2.4.4-2.4.9 and Commerce B2B 1.3.x-1.5.x, so upgrade to the fixed 2026-aug patch release published in that bulletin for your installed line (an exact fixed build number is not enumerated in the provided data - take the version Adobe designates as patched in APSB26-138). As compensating controls until patched, place the admin panel behind an allowlisted VPN/IP restriction so attacker-viewable content is not rendered to admins from untrusted networks, enable and tighten a Content-Security-Policy (Magento ships CSP support) in restrict/report mode to limit inline-script execution - noting this can break legitimate inline scripts and third-party extensions - and add a WAF rule to filter script payloads in the affected form fields, accepting that WAF filtering is bypassable and not a substitute for the patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected products are Adobe's Magento-based e-commerce platform (Adobe Commerce, Adobe Commerce B2B, and the open-source Magento Open Source), a PHP application that renders user-supplied data across storefront and admin interfaces. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): data submitted into 'vulnerable form fields' is stored and later reflected into rendered HTML without adequate output encoding or sanitization, allowing script injection. The changed scope (S:C) in the CVSS vector indicates the injected script executes in a security context different from where it was injected - consistent with attacker input that is stored via one interface (e.g. a storefront/customer-facing form) and rendered in a higher-privilege context such as the merchant admin panel.
Know when Commerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Network-reachable unauthenticated stored injection (PR:N) needing a victim to view the page (UI:R); script runs in a different context (S:C) enabling session/account compromise (C:H/I:H, A:N).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
Articles & Coverage 1
Executive ViewAI
E-commerce businesses using Adobe Commerce, Magento Open Source, or Adobe Commerce B2B face a critical security gap: attackers can hide malicious code in form fields that silently captures and hijacks administrator session tokens when staff access affected forms. Without an available vendor patch and given the CVSS 9.3 severity rating, this exposure directly threatens payment processing integrity, customer data confidentiality, and administrative control. The vulnerability's scope-change characteristic means a single compromised admin session could provide attackers broad access to modify inventory, orders, customer records, and payment settings.
Implement Web Application Firewall rules to block common XSS payloads in form fields; deploy restrictive Content Security Policy headers to prevent inline JavaScript execution; restrict administrative console network access to allowlisted IP ranges; enforce multi-factor authentication on all administrator accounts; enable granular logging and alerting for admin logins and form submission activity; conduct daily review of application logs for XSS exploitation indicators; consider temporary suspension of non-critical user-input forms; isolate compromised instances from production environment if active exploitation is detected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Privilege escalation in Adobe Commerce and Magento Open Source (including Adobe Commerce B2B) lets a remote attacker gai
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML E
SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create
SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools r
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication v
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulne
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improp
If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterize
SAP Commerce, versions - 6.7, 1808, 1811, 1905, and SAP Commerce (Data Hub), versions - 6.7, 1808, 1811, 1905, allows an
Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting (XSS) vul
Stored cross-site scripting in Adobe Commerce, Magento Open Source, and Adobe Commerce B2B (versions through the August
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect A
Exploit-DB