Stored Cross-Site Scripting Vulnerability in Adobe Commerce
CVE-2026-48414

7.7HIGH

Key Information:

Vendor

Adobe
Status
Adobe Commerce
Adobe Commerce B2b
Magento Open Source
Vendor
CVE Published:
11 August 2026

What is CVE-2026-48414?

Adobe Commerce has a vulnerability that allows low-privileged attackers to inject harmful scripts into form fields. Users browsing affected pages may unknowingly execute malicious JavaScript in their browsers. This can lead to unauthorized access and control over user sessions, depending on various conditions that the attacker cannot manipulate. Protecting against this vulnerability is crucial to ensure user session integrity and data security.

Affected Version(s)

Adobe Commerce 0 <= 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug

Adobe Commerce 0 <= 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug

Adobe Commerce B2B 0 <= 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul

References

https://helpx.adobe.com/security/products/magento/apsb26-...
vendor-advisory

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.