CVE-2026-76200: Adobe Magento Stored XSS Vulnerability

CVE-2026-76200 Overview

Adobe Commerce, Adobe Magento Open Source, and Adobe Commerce B2B contain a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting form field input handling. An attacker can inject malicious JavaScript into vulnerable form fields, which executes in a victim's browser when they visit the page containing the tainted content. Successful exploitation can lead to session hijacking, account takeover, or elevated access within the affected storefront or admin context. The vulnerability carries a changed scope, meaning injected scripts can affect resources beyond the initially vulnerable component. Adobe published the security advisory APSB26-138 addressing this issue across multiple product lines.

Critical Impact
An unauthenticated network-based attacker can plant persistent JavaScript payloads that execute in the browsers of administrators or customers, enabling account takeover across Adobe Commerce storefronts.

Affected Products

Adobe Magento Open Source (versions 2.4.7 through 2.4.9, including patch and beta releases)
Adobe Commerce (versions 2.4.4 through 2.4.9, including all listed patch levels)
Adobe Commerce B2B (versions 1.3.3 through 1.5.3, including all listed patch levels)

Discovery Timeline

2026-09-08 - CVE-2026-76200 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-76200

Vulnerability Analysis

The flaw is a stored Cross-Site Scripting weakness classified under [CWE-79], Improper Neutralization of Input During Web Page Generation. Adobe Commerce accepts input into form fields without sufficiently sanitizing or encoding script-bearing content before persisting and later rendering it. When a subsequent user loads the page that displays the stored input, their browser parses and executes the attacker-supplied JavaScript in the context of the Commerce application. Because the vulnerability has a changed scope, the injected script can influence resources managed by components outside the initially compromised one, expanding the blast radius across the storefront and administrative interfaces.

Root Cause

The root cause is missing or inadequate output encoding on data that flows from user-controllable form fields into HTML rendering paths. Content submitted through the affected fields is written to persistent storage and later reflected into responses without contextual escaping, allowing raw <script> tags or JavaScript event handlers to reach the DOM intact.

Attack Vector

Exploitation occurs over the network and requires user interaction, typically another user browsing to the page that renders the malicious content. The attacker does not need prior authentication. Once a victim loads the page, the payload executes with the victim's session privileges, permitting cookie theft, CSRF token exfiltration, administrative action forgery, or credential harvesting through injected forms.

No verified public proof-of-concept code is available. Refer to the Adobe security advisory APSB26-138 for vendor-provided technical details.

Detection Methods for CVE-2026-76200

Indicators of Compromise

Form field values in the Magento database containing <script>, javascript:, onerror=, onload=, or encoded variants such as <script
Unexpected outbound HTTP requests from admin or customer browsers to unfamiliar domains during storefront navigation
New or modified administrator accounts created shortly after admin users viewed pages containing customer-submitted content
Session cookies for /admin paths appearing in referrer or query strings on external servers

Detection Strategies

Query product, customer, order, and CMS tables for HTML or script markup in fields that should hold plain text
Review web server access logs for POST requests to storefront form endpoints containing script tags or URL-encoded payload markers
Enable Content Security Policy (CSP) reporting to capture violations from injected inline scripts
Correlate admin panel activity with prior views of user-generated content pages to identify potential session takeover chains

Monitoring Recommendations

Alert on database writes to Adobe Commerce content tables containing HTML script constructs from unauthenticated or low-privilege sessions
Monitor administrator session activity for anomalous privilege changes, extension installs, or configuration edits
Track outbound connections from browsers accessing the Commerce admin interface to non-corporate destinations

How to Mitigate CVE-2026-76200

Immediate Actions Required

Apply the security updates referenced in Adobe advisory APSB26-138 to all Adobe Commerce, Magento Open Source, and Commerce B2B installations
Audit customer-submitted content, product data, and CMS blocks for existing script payloads and remove any malicious entries
Rotate administrator credentials and invalidate active admin sessions after patching
Enable and enforce a strict Content Security Policy that disallows inline scripts on admin and storefront pages

Patch Information

Adobe has released fixed builds addressed in the Adobe Magento Security Advisory APSB26-138. Administrators should upgrade to the patched release listed for their deployed branch (Commerce 2.4.4 through 2.4.9, Magento Open Source 2.4.7 through 2.4.9, and Commerce B2B 1.3.3 through 1.5.3) and validate the upgrade using Adobe's post-installation checks.

Workarounds

Restrict administrator access to the /admin interface using IP allow-listing or VPN gating until the patch is applied
Deploy a Web Application Firewall (WAF) rule set to strip or block script tags and JavaScript event handler attributes in form submissions
Disable or restrict features that render user-generated HTML content, such as customer reviews or product Q&A modules, where feasible

bash

# Example: Nginx location block restricting admin access by IP
location ^~ /admin {
    allow 203.0.113.0/24;
    deny all;
    proxy_pass http://magento_backend;
}