Executive brief
Adobe Commerce, a popular e-commerce platform used for online storefronts, is affected by a security vulnerability that allows high-privileged users to inject malicious scripts into the website. If a victim views a page containing these scripts, an attacker could potentially take control of the victim's session or account. This could lead to unauthorized access to sensitive customer data or administrative functions.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in Adobe Commerce, Magento Open Source, and related components due to improper neutralization of input during web page generation (CWE-79). A high-privileged attacker can inject malicious JavaScript into vulnerable form fields. The attack requires the victim to interact with the page where the script is stored (UI:R). Because the vulnerability has a changed scope (S:C), the injected script can impact components beyond the immediate vulnerable field, potentially leading to full session hijacking or account takeover. Patches are available in the July 2026 release cycle (e.g., Adobe Commerce 2.4.9-2026-jul).
Affected products
- Adobe Adobe Commerce <= 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18
- Adobe Adobe Commerce B2B <= 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18
- Adobe Magento Open Source <= 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15
- Adobe Adobe Commerce Webhooks Plugin <= 1.20.0
Timeline
- 2026-07-14: advisory: Adobe published security bulletin APSB26-73
- 2026-07-14: disclosed