CVE-2026-48371: Adobe Commerce Stored XSS Vulnerability

CVE-2026-48371 Overview

Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting multiple versions of Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and Adobe I/O Events for Commerce. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they load the page containing the compromised field.

The vulnerability carries a scope change, meaning the impact extends beyond the vulnerable component to affect other resources such as browser sessions of authenticated administrators. Adobe published the advisory APSB26-73 addressing this issue.

Critical Impact
Attackers with low-privileged accounts can persist malicious scripts in Adobe Commerce storefronts and administrative interfaces, enabling session theft, credential harvesting, and unauthorized actions in the context of higher-privileged victims.

Affected Products

Adobe Commerce versions 2.4.4 through 2.4.9 (including all patch levels)
Adobe Commerce B2B versions 1.3.3, 1.3.4, 1.4.2, 1.5.2, and 1.5.3
Magento Open Source 2.4.6 through 2.4.9 and Adobe I/O Events for Commerce

Discovery Timeline

2026-07-14 - CVE-2026-48371 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-48371

Vulnerability Analysis

The vulnerability is a stored (persistent) Cross-Site Scripting flaw classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation). Adobe Commerce fails to properly sanitize or encode user-supplied input submitted through certain form fields before storing it and rendering it back to users. When a subsequent user loads the affected page, the browser executes the attacker's JavaScript within the trust context of the Adobe Commerce application.

Because the CVSS scope is changed, the injected script can affect components beyond the initially vulnerable one. In practical terms, a low-privileged user (such as a limited backend account, a B2B customer, or a merchant employee) can plant a payload that later executes in the browser of an administrator or another merchant user.

Root Cause

The root cause is insufficient output encoding and input validation when handling data written into form fields that are later reflected in HTML responses. Adobe Commerce's template rendering pipeline emits the stored value without applying context-appropriate escaping (HTML entity encoding, JavaScript string escaping, or attribute encoding), allowing raw <script> tags or event-handler attributes to persist and execute.

Attack Vector

Exploitation requires network access to the Adobe Commerce application, a low-privileged authenticated account, and user interaction from the victim (the victim must browse to the affected page). The attacker submits a crafted payload into a vulnerable form field through the normal application interface. The payload is stored server-side. When any user with a session loads the page containing that field, the injected JavaScript runs in their browser and can steal session cookies, perform actions on their behalf via authenticated requests, or pivot toward administrative account takeover.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-48371

Indicators of Compromise

Unexpected <script>, onerror, onload, or javascript: strings persisted in form-related database tables such as customer attributes, product attributes, CMS blocks, and B2B company records
Outbound HTTP requests from administrator browsers to attacker-controlled domains shortly after loading Adobe Commerce backend pages
Anomalous administrative actions (user creation, permission changes) originating from legitimate admin sessions without corresponding user activity

Detection Strategies

Audit stored content in Adobe Commerce form fields for HTML tags, event handlers, and encoded script payloads using database queries and application-level scans
Deploy a Web Application Firewall (WAF) rule set that inspects form submissions for XSS signatures and log matches for review
Enable and monitor Content Security Policy (CSP) violation reports to identify unexpected script sources loading in admin and storefront contexts

Monitoring Recommendations

Forward Adobe Commerce application logs, web server access logs, and admin activity logs to a centralized SIEM for correlation of suspicious form submissions and follow-on admin actions
Alert on repeated form submissions from low-privileged accounts containing HTML control characters (<, >, ", ') that survive server-side processing
Track browser session anomalies including unexpected cookie exfiltration attempts and DOM modifications on Adobe Commerce admin pages

How to Mitigate CVE-2026-48371

Immediate Actions Required

Apply the security updates referenced in Adobe Magento Security Advisory APSB26-73 as soon as maintenance windows allow
Review and restrict privileges of backend user accounts, removing form-field write access for accounts that do not require it
Audit existing stored content in vulnerable form fields and remove any injected script payloads discovered

Patch Information

Adobe released fixes under advisory APSB26-73. Administrators should upgrade Adobe Commerce, Adobe Commerce B2B, and Magento Open Source to the patched versions listed in the advisory. Adobe I/O Events for Commerce should also be updated to the latest release. See the Adobe Magento Security Advisory for exact patched version numbers per product line.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins, reducing the impact of injected payloads
Place a WAF in front of Adobe Commerce with rules that block common XSS patterns in POST parameters targeting admin and B2B endpoints
Restrict access to Adobe Commerce admin interfaces to trusted IP ranges or VPN-only access until patches are applied

bash

# Example Content Security Policy header to reduce XSS impact
Header set Content-Security-Policy "default-src 'self'; \
  script-src 'self' https://trusted-cdn.example.com; \
  object-src 'none'; \
  base-uri 'self'; \
  frame-ancestors 'self'; \
  report-uri /csp-violation-report"