Stored Cross-Site Scripting Vulnerability in Adobe Commerce
CVE-2026-34658

4.8MEDIUM

Key Information:

Vendor

Adobe
Status
Adobe Commerce
Vendor
CVE Published:
12 May 2026

What is CVE-2026-34658?

Adobe Commerce versions 2.4.9-beta1 and earlier are vulnerable to a stored Cross-Site Scripting (XSS) attack, allowing high-privileged attackers to inject malicious JavaScript into form fields. This vulnerability enables the execution of harmful scripts in the browser of legitimate users who access the compromised pages. Proper validation and sanitization of user input are essential to mitigate such risks.

Affected Version(s)

Adobe Commerce 0 <= 2.4.4-p17

References

https://helpx.adobe.com/security/products/magento/apsb26-...
vendor-advisory

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.