CVE-2026-34655: Adobe Commerce Stored XSS Vulnerability

CVE-2026-34655 Overview

CVE-2026-34655 is a stored Cross-Site Scripting (XSS) vulnerability affecting multiple versions of Adobe Commerce. The flaw resides in form field input handling, where a high-privileged attacker can inject malicious scripts into vulnerable fields. When a victim browses to a page containing the tainted field, the injected JavaScript executes in their browser. The vulnerability has a scope change, meaning the compromised component impacts resources beyond its security boundary. Adobe assigned this issue [CWE-79] under security advisory APSB26-49.

Critical Impact

A high-privileged attacker can inject persistent JavaScript that executes in any user's browser session visiting the affected page, enabling session compromise and unauthorized actions in the victim's context.

Affected Products

• Adobe Commerce 2.4.9-beta1
• Adobe Commerce 2.4.8-p4, 2.4.7-p9, 2.4.6-p14
• Adobe Commerce 2.4.5-p16, 2.4.4-p17 and earlier

Discovery Timeline

• 2026-05-12 - CVE-2026-34655 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-34655

Vulnerability Analysis

The vulnerability is a stored XSS flaw [CWE-79] within Adobe Commerce form fields. Stored XSS occurs when user-controlled input is persisted to a backend store and later rendered in HTML responses without proper output encoding. In this case, an attacker with high privileges submits crafted JavaScript through a form input that fails to sanitize or encode special characters.

The persisted payload triggers when an authenticated user navigates to a page that renders the affected field. The script then executes under the victim's origin and session context. Because the CVSS scope is changed, the executed script can affect resources beyond the originally exploited component, such as administrative consoles or storefront sessions belonging to other users. Exploitation requires user interaction by the victim, who must load the affected page.

Root Cause

The root cause is missing or insufficient output encoding on form field values rendered back into the Document Object Model (DOM). Adobe Commerce trusts input supplied by high-privileged accounts, allowing raw HTML and script content to pass through templating without contextual escaping.

Attack Vector

Exploitation occurs over the network. An authenticated attacker with administrative or merchant-level privileges submits a payload such as <script> tags or event handler attributes into a vulnerable field. When a legitimate user, such as another administrator or customer-facing employee, opens the affected page, the script executes in their browser. The attacker can steal session tokens, perform actions on behalf of the victim, or pivot deeper into the merchant backend.

No verified public proof-of-concept code is available. For technical specifics, refer to the Adobe Security Advisory APSB26-49.

Detection Methods for CVE-2026-34655

Indicators of Compromise

• Unexpected <script>, <img onerror=>, or javascript: payloads stored within Adobe Commerce entity attributes, product descriptions, CMS blocks, or admin form fields.
• Outbound HTTP requests from admin or storefront browsers to attacker-controlled domains shortly after page loads.
• Anomalous session token usage or admin account activity originating from unfamiliar IP addresses.

Detection Strategies

• Audit Adobe Commerce database tables and configuration entries for HTML or script syntax in fields expected to contain plain text.
• Monitor web server access logs for admin endpoint requests submitting payloads containing encoded <, >, or script keywords.
• Review Content Security Policy (CSP) violation reports for inline script execution events on Adobe Commerce pages.

Monitoring Recommendations

• Enable verbose admin activity logging and forward events to a centralized SIEM for correlation across admin sessions.
• Track creation and modification of high-privileged accounts that could be leveraged to plant stored XSS payloads.
• Alert on browser-side errors and CSP report-only violations originating from /admin and catalog rendering endpoints.

How to Mitigate CVE-2026-34655

Immediate Actions Required

• Apply the security updates referenced in Adobe Security Advisory APSB26-49 to all affected Adobe Commerce installations.
• Audit existing high-privileged accounts and remove unused or unnecessary administrative access.
• Review stored content in product, category, CMS, and configuration fields for previously injected payloads.

Patch Information

Adobe released patched versions of Commerce addressing CVE-2026-34655 as part of advisory APSB26-49. Administrators running 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 or earlier must upgrade to the corresponding fixed release listed in the Adobe Security Advisory APSB26-49.

Workarounds

• Enforce a strict Content Security Policy that blocks inline scripts and restricts script sources to trusted origins.
• Restrict admin panel access to known IP ranges using web server or web application firewall rules.
• Require multi-factor authentication on all high-privileged Adobe Commerce accounts to reduce risk of credential compromise.

# Example: enforce CSP header in nginx for Adobe Commerce admin paths
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';" always;