# CVE-2026-76201: Adobe Commerce stored XSS in form fields

Source: https://junglewise.ai/threats/cve-2026-76201-adobe-commerce-stored-xss-in-form-fields  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-76201 · Severity: critical · CVSS 9.3 · Published 2026-09-08

Adobe Commerce is an e-commerce platform used by retailers to manage online stores and customer transactions. A stored cross-site scripting vulnerability allows attackers to inject malicious scripts into form fields, which execute when administrators or customers view affected pages. Successful exploitation could lead to account takeover, session hijacking, or theft of sensitive customer or business data.

Technologies: [Adobe Commerce](https://junglewise.ai/threats/technologies/commerce). Vendors: [Adobe](https://junglewise.ai/threats/vendors/adobe).

## Quick answers

**Is CVE-2026-76201 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76201 being exploited in the wild.

**How severe is CVE-2026-76201?** Critical severity, with a CVSS score of 9.3, published 8 September 2026.

**Which products and versions are affected?** Adobe Commerce <UNKNOWN>.

**Is there a fix for CVE-2026-76201?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-76201 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-76201?** Check whether you run Adobe Commerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a stored cross-site scripting (XSS) vulnerability in Adobe Commerce that permits injection of malicious JavaScript into form fields without proper sanitization or encoding. The vulnerability changes scope, meaning an attacker can potentially execute code with elevated privileges or affect other users' sessions. Attack vector is network-based and likely requires low or no authentication depending on which form fields are affected. Once injected, the malicious script persists and executes in the browsers of any user who accesses the affected page, potentially enabling session hijacking, credential theft, or account compromise. Patch availability should be confirmed through Adobe's official security bulletin.

## Affected products

- Adobe Commerce <UNKNOWN>

## Timeline

- 2026-09-08: disclosed

## References

- [https://helpx.adobe.com/security/products/magento/apsb26-138.html](https://helpx.adobe.com/security/products/magento/apsb26-138.html)

## Related threats

- [Adobe Commerce improper input validation in file write](https://junglewise.ai/threats/cve-2026-95631-adobe-commerce-is-affected-by-an-improper-input-validation)
- [Adobe Commerce improper input validation in security feature](https://junglewise.ai/threats/cve-2026-95630-adobe-commerce-is-affected-by-an-improper-input-validation)
- [Adobe Commerce stored XSS vulnerability in form fields](https://junglewise.ai/threats/cve-2026-92922-adobe-commerce-is-affected-by-a-stored-cross-site-scripting-xss)
- [Adobe Commerce stored XSS in form fields](https://junglewise.ai/threats/cve-2026-92911-adobe-commerce-is-affected-by-a-stored-cross-site-scripting-xss)
- [Adobe Commerce incorrect authorization security feature bypass](https://junglewise.ai/threats/cve-2026-92910-adobe-commerce-is-affected-by-an-incorrect-authorization)