CVE-2026-47994: Adobe Commerce XSS Vulnerability

CVE-2026-47994 Overview

CVE-2026-47994 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and Adobe I/O Events for Commerce. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they visit the page containing the tainted field. Successful exploitation can lead to session hijacking or unauthorized actions performed within the victim's account context. The vulnerability has a changed scope, meaning the injected script can affect resources beyond the vulnerable component.

Critical Impact
Authenticated attackers with low privileges can execute arbitrary JavaScript in victim browsers, potentially compromising administrator sessions and gaining elevated access to Adobe Commerce storefronts.

Affected Products

Adobe Commerce (versions 2.4.4 through 2.4.9, including all patch levels)
Adobe Commerce B2B (versions 1.3.3 through 1.5.3)
Magento Open Source (versions 2.4.6 through 2.4.9) and Adobe I/O Events for Commerce

Discovery Timeline

2026-07-14 - CVE-2026-47994 published to the National Vulnerability Database
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-47994

Vulnerability Analysis

CVE-2026-47994 is a stored XSS flaw in Adobe Commerce form field handling. The application persists user-supplied input from form fields without adequate output encoding or input sanitization. When another user renders a page containing the stored input, the browser interprets the payload as executable JavaScript instead of inert data.

The attack requires authenticated access with low privileges and user interaction to trigger the payload. However, the changed scope indicates the injected script can reach resources managed by a different security authority than the vulnerable component. In practice, this often means a low-privileged storefront or catalog user can target administrative sessions.

Root Cause

The root cause is improper neutralization of input during web page generation, tracked as [CWE-79]. Vulnerable form field handlers accept attacker-controlled markup and later render it into HTML responses without context-appropriate escaping. Encoding routines are either absent or applied to the wrong context, allowing <script> tags or event handler attributes to survive into the DOM.

Attack Vector

An attacker with a low-privileged Adobe Commerce account submits crafted JavaScript payloads into a vulnerable form field, such as a customer profile, catalog metadata, or B2B company data. The payload is stored server-side. When an administrator or another user later views the page rendering that field, the script executes in their browser under the origin of the Commerce application.

The attacker can then steal session cookies, issue authenticated API calls, modify catalog data, or pivot to further compromise of the storefront. Because the flaw is network-reachable through the standard web interface, no additional network position is required.

Detection Methods for CVE-2026-47994

Indicators of Compromise

Form field values containing HTML tags such as <script>, <img onerror=>, <svg onload=>, or javascript: URIs stored in Commerce database tables
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after loading Commerce admin pages
New administrator accounts, altered permissions, or unauthorized configuration changes following admin sessions on pages that render user-supplied fields
Content Security Policy (CSP) violation reports referencing inline script execution on Commerce admin pages

Detection Strategies

Query Commerce database tables (customer, catalog, quote, company) for stored values matching XSS payload patterns using regular expressions targeting HTML event handlers and script tags
Enable and monitor Content Security Policy reporting endpoints for Commerce storefront and admin domains
Review web server access logs for POST requests to form-handling endpoints containing URL-encoded script fragments
Correlate admin authentication events with subsequent anomalous administrative actions, such as user creation or role modification

Monitoring Recommendations

Instrument Commerce application logs to capture the identity of users submitting values that fail server-side validation
Deploy a Web Application Firewall (WAF) with rules that alert on XSS signatures targeting Adobe Commerce endpoints
Monitor administrator browser sessions for unexpected script execution using browser isolation or endpoint telemetry
Track access to /admin paths and correlate with newly stored form field content submitted by low-privileged accounts

How to Mitigate CVE-2026-47994

Immediate Actions Required

Apply the security updates listed in Adobe Security Bulletin APSB26-73 to all affected Adobe Commerce, Commerce B2B, Magento Open Source, and I/O Events for Commerce installations
Audit low-privileged accounts and disable any that are unused or exhibit suspicious submission activity
Review recently modified customer, catalog, and B2B company records for embedded script content and sanitize identified entries
Rotate administrator session tokens and require re-authentication after patching

Patch Information

Adobe published fixes as part of security bulletin APSB26-73. Administrators should upgrade to the patched releases documented in the Adobe Security Bulletin. Adobe I/O Events for Commerce should be updated to the latest module version noted in the same advisory.

Workarounds

Deploy or tighten a Content Security Policy that blocks inline script execution on Commerce admin and storefront domains until patches can be applied
Restrict access to the Commerce admin interface to trusted IP ranges using network controls or reverse proxy rules
Temporarily reduce the number of accounts holding privileges required to submit content to affected form fields
Enable WAF signatures that detect and block common stored XSS payload patterns targeting Adobe Commerce endpoints

bash

# Example nginx configuration to restrict admin access and enforce CSP headers
location /admin {
    allow 203.0.113.0/24;
    deny all;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
}