CVE-2026-47999
MediumCVSS 4.8Exploitation Probability (EPSS)
Very high risk93th percentile - higher than 93% of all known CVEs
Summary
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Risk Assessment
The risk involves potential session theft, account takeover, or unauthorized actions performed on behalf of the victim, which could lead to data confidentiality and integrity breaches within the organization.
Recommendation
It is recommended to immediately update Adobe Commerce to the latest version containing the security patch and to restrict user privileges to the minimum necessary.
Original NVD description (English source)
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.