CVE-2026-47999: Adobe Commerce XSS Vulnerability

CVE-2026-47999 Overview

Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting multiple versions of Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and Adobe I/O Events for Commerce. A high-privileged attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they navigate to the page containing the tainted field. The scope is changed, meaning the injected script can affect resources beyond the vulnerable component's authorization boundary. Adobe published the security bulletin APSB26-73 addressing this issue.

Critical Impact
Authenticated administrators can inject persistent JavaScript that executes in other users' browsers, enabling session theft, admin panel manipulation, and cross-component attacks due to the changed scope.

Affected Products

Adobe Commerce versions 2.4.4 through 2.4.9 (including all patch levels)
Adobe Commerce B2B versions 1.3.3 through 1.5.3 (including all patch levels)
Adobe Magento Open Source 2.4.6 through 2.4.9 and Adobe I/O Events for Commerce

Discovery Timeline

2026-07-14 - CVE CVE-2026-47999 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-47999

Vulnerability Analysis

The vulnerability is a stored XSS flaw in Adobe Commerce form field handling. The application persists attacker-supplied input without adequate output encoding or input sanitization. When a legitimate user later views a page rendering that stored data, the browser interprets the injected content as executable JavaScript rather than inert text.

Exploitation requires high privileges, meaning the attacker must already hold an administrative or elevated role within the Commerce backend. User interaction is also required, as a victim must load the affected page. However, the changed scope indicates the injected script can reach beyond the initially vulnerable component and influence data or functionality owned by other trust boundaries.

The EPSS probability for this CVE sits in the upper percentiles relative to peer vulnerabilities, indicating elevated interest despite the privilege prerequisites.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Adobe Commerce accepts user-supplied values for specific form fields, stores them in the backing database, and renders them into HTML contexts without contextual escaping. Because encoding is missing at the render sink, script-bearing payloads survive round-trips and execute on retrieval.

Attack Vector

An authenticated attacker with high privileges accesses an administrative form containing a vulnerable field. The attacker submits a payload combining HTML markup and JavaScript. The application saves the payload verbatim. When another authenticated user loads the page containing the stored field, the browser parses and executes the payload in that user's session context. Because scope changes, the executed script can reach resources outside the original component, including administrative APIs, session cookies not marked HttpOnly, and other Commerce subsystems.

No verified proof-of-concept code is publicly available. Refer to the Adobe Security Bulletin APSB26-73 for authoritative technical detail.

Detection Methods for CVE-2026-47999

Indicators of Compromise

Unexpected <script>, onerror=, onload=, or javascript: fragments appearing in Adobe Commerce database tables that back administrative form fields
Admin session cookies transmitted to external domains in web server or proxy logs
Anomalous outbound requests initiated from browsers of admin users while viewing Commerce backend pages
Adobe Commerce audit log entries showing form updates by administrative accounts immediately followed by unusual API calls

Detection Strategies

Perform database queries against Commerce entity attribute tables for HTML control characters and script-like tokens in text fields not intended to contain markup
Deploy a Content Security Policy (CSP) in report-only mode and monitor report-uri endpoints for inline-script violations originating from admin URLs
Inspect web application firewall (WAF) logs for POST requests to admin form endpoints containing encoded script payloads

Monitoring Recommendations

Monitor administrative account activity for unusual form modifications, especially by accounts that rarely edit configuration data
Alert on new outbound network connections from browser sessions authenticated to /admin URIs
Correlate admin login events with subsequent Commerce API calls that fall outside the user's typical behavior baseline

How to Mitigate CVE-2026-47999

Immediate Actions Required

Apply the Adobe security update referenced in APSB26-73 to all affected Commerce, Commerce B2B, and Magento Open Source deployments
Audit all administrative accounts and revoke unnecessary high-privilege roles
Review recent modifications to Commerce form data and remove any embedded script payloads discovered

Patch Information

Adobe released fixes documented in security bulletin APSB26-73. Administrators should upgrade to the latest patched release for their major version branch (2.4.4 through 2.4.9 for Commerce, 1.3.3 through 1.5.3 for Commerce B2B, and equivalent Magento Open Source releases). Consult the Adobe Security Bulletin APSB26-73 for exact fixed version numbers per product line.

Workarounds

Enforce least-privilege access controls and restrict admin panel accounts to only those users who require them
Deploy a strict Content Security Policy that disallows inline scripts and unsafe-eval in Commerce admin interfaces
Place the Commerce admin URL behind an IP allowlist or VPN to reduce exposure to compromised administrative credentials
Enable multi-factor authentication for every administrative account to make privilege abuse harder

bash

# Example CSP header for Commerce admin (nginx)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;