Adobe Commerce CVE-2026-92922

Requires the attacker to already possess a high-privileged backend account in Adobe Commerce, Adobe Commerce B2B, or Magento Open Source with the ability to write to the affected admin form fields (PR:H). Exploitation is NOT automatic: a second victim user must subsequently browse to the page that renders the stored field for the injected JavaScript to execute (UI:R). The payload persists server-side (stored XSS), and the scope change (S:C) reflects impact on the victim's browser/session security context rather than the injecting account. Limiting factors: no unauthenticated or low-privilege path exists, so the flaw is primarily an insider-abuse or post-compromise privilege-escalation vector rather than a remotely exploitable entry point.

This is a medium-to-moderate real-world priority rather than a top-tier emergency, despite the 8.1 'High' CVSS base score. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C) shows the score is inflated primarily by the scope change (S:C) and dual High confidentiality/integrity impact, but it is gated by two significant barriers: PR:H means the attacker must already hold high (administrative) privileges in the Commerce/Magento backend, and UI:R means a victim must actively browse the page hosting the injected script. No EPSS score, KEV listing, or public POC was provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The chief signals therefore point the same direction and are not in conflict: a high-privilege-required stored XSS is realistically an insider/post-compromise or privilege-abuse issue rather than a mass-exploitable internet-facing flaw. EPSS is absent (not low) and should not be read as either confirmation or exoneration. The main caveat: the input provides no EPSS/KEV/POC data at all, so the exploitation-likelihood dimension is unmeasured rather than confirmed-benign - treat prioritization as 'patch in normal cycle' absent new exploitation signals.

A malicious or compromised administrator (or a lower-admin with form-editing rights) injects JavaScript into a vulnerable backend form field in Adobe Commerce/Magento. When another privileged user later views the page rendering that field, the script executes in their authenticated session, allowing the attacker to hijack that session or escalate access. No public exploit code was identified in the provided intelligence; exploitation requires an existing high-privilege foothold plus victim interaction.