What is the CVSS score of EUVD-2026-56848?

EUVD-2026-56848 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.6%.

Which versions of Adobe Commerce are affected by EUVD-2026-56848?

Adobe Commerce and Magento Open Source users face a critical vulnerability enabling low-privileged attackers to inject persistent malicious code that executes when other users visit compromised…

How to fix or mitigate EUVD-2026-56848?

Within 24 hours: identify all Adobe Commerce and Magento Open Source instances in production and document current versions; audit which form fields accept user input from low-privileged accounts. Within 7 days: test the patched August 2026 builds in staging environments to verify compatibility with your deployment and custom extensions. Within 30 days: deploy patched August 2026 builds to all production instances per advisory APSB26-92, and conduct a security audit of stored form field content to detect any injected malicious scripts.

Adobe Commerce EUVD-2026-56848

| CVE-2026-48413 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-11 psirt@adobe.com

GHSA-g35r-hm8j-j3gm

XSS Adobe

8.7

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

Network-accessible stored XSS requires a low-privileged account (PR:L) and victim page visit (UI:R); scope change (S:C) reflects script execution in victim's browser context enabling account takeover with no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 19:41 vuln.today

CVE Published

Aug 11, 2026 - 18:17 nvd

HIGH 8.7

DescriptionCVE.org

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

AnalysisAI

Stored XSS in Adobe Commerce and Magento Open Source enables a low-privileged attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in a victim's browser upon page visit - with scope change allowing script execution beyond the vulnerable component's security boundary, potentially enabling full account or session takeover. The CVSS 8.7 High score reflects network accessibility, low complexity, changed scope, and high confidentiality and integrity impact. No active exploitation (KEV) or public POC has been identified at time of analysis; Adobe released patched August 2026 builds across all affected product lines per advisory APSB26-92.

Technical ContextAI

Adobe Commerce (formerly Magento) is a PHP-based enterprise e-commerce platform. This vulnerability is a persistent (stored) XSS instance, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), where user-supplied data submitted to one or more form fields is persisted to a data store without adequate sanitization and later rendered in HTML responses without proper output encoding. When the stored payload is rendered in another user's browser, the injected JavaScript executes within the application's origin context, enabling cookie and session token exfiltration, DOM manipulation, credential harvesting, or forced actions on behalf of the victim. The CVSS S:C (Scope Changed) metric is technically accurate: stored XSS by definition crosses a security boundary - the injected payload originates from the attacker's session but executes in the victim's browser security context. Affected products span Adobe Commerce versions through the July 2026 monthly patch level, Magento Open Source through the same range, and the Adobe Commerce B2B extension through the July 2026 patch level.

RemediationAI

Apply Adobe's August 2026 security patches immediately. For Adobe Commerce, upgrade to 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, or 2.4.4-2026-aug depending on your active branch. For Magento Open Source, upgrade to 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, or 2.4.6-2026-aug. For the Adobe Commerce B2B extension, upgrade to 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, or 1.3.3-2026-aug. Patch and installation guidance is available at https://helpx.adobe.com/security/products/magento/apsb26-92.html. If immediate patching is not feasible, deploy a WAF with strict XSS filtering rules on Commerce form endpoints - note this may produce false positives on legitimate rich-text product description fields and require tuning. Additionally, restrict customer self-registration to reduce the pool of low-privileged accounts capable of injecting payloads, and audit existing stored content in user-editable fields for suspicious script patterns as a forensic precaution.