CVE-2026-76201: Adobe Commerce Stored XSS Vulnerability

CVE-2026-76201 Overview

Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. Attackers can inject malicious JavaScript into vulnerable form fields, which executes in the browsers of victims who visit affected pages. The vulnerability has a changed scope, meaning exploitation impacts resources beyond the vulnerable component. Successful exploitation can lead to session hijacking, account takeover, or elevated access within the storefront and administrative interfaces. The vulnerability is tracked under CWE-79 and documented in Adobe security bulletin APSB26-138.

Critical Impact
Attackers can persistently inject JavaScript into Adobe Commerce form fields, executing arbitrary scripts in victim browsers with scope change to compromise sessions and account privileges.

Affected Products

Adobe Commerce versions 2.4.4 through 2.4.9 (including all patch releases)
Adobe Commerce B2B versions 1.3.3, 1.3.4, 1.4.2, 1.5.2, and 1.5.3 (including patch releases)
Magento Open Source versions 2.4.7, 2.4.8, and 2.4.9 (including patch and beta releases)

Discovery Timeline

2026-09-08 - CVE-2026-76201 published to NVD
2026-09-09 - Last updated in NVD database
APSB26-138 - Adobe releases security bulletin with patch information

Technical Details for CVE-2026-76201

Vulnerability Analysis

The vulnerability is a stored XSS flaw [CWE-79] in Adobe Commerce form field handling. Adobe Commerce fails to properly sanitize user-supplied input before persisting it and rendering it back to other users. Attackers submit crafted payloads containing JavaScript into vulnerable form fields, and the application stores this input without adequate encoding.

When another user browses to a page that renders the stored data, the malicious script executes in the victim's browser context. The scope change indicated in the vulnerability metadata means the attack affects resources beyond the initially vulnerable component, enabling cross-boundary compromise between customer-facing storefronts and administrative interfaces.

Exploitation requires network access and some user interaction, such as an administrator or shopper viewing an affected page. No authentication is required to submit the malicious payload, which broadens the attacker population significantly.

Root Cause

The root cause is insufficient input validation and output encoding in form field processing. The affected form handlers accept user input containing HTML and JavaScript constructs, store the data in backend systems, and later render it into HTML pages without contextual escaping. This violates output encoding requirements defined by the OWASP XSS prevention guidance.

Attack Vector

An unauthenticated attacker submits a form containing a JavaScript payload embedded in a vulnerable field. The Adobe Commerce backend persists the payload. When a legitimate user, such as a store administrator or customer service agent, opens the record or page that renders the field, their browser executes the attacker's script. The attacker can then steal session cookies, perform actions on behalf of the victim, exfiltrate sensitive order data, or pivot to administrative functions.

No verified public exploit code or proof-of-concept was available at the time of publication. Refer to the Adobe Security Bulletin APSB26-138 for vendor-provided technical details.

Detection Methods for CVE-2026-76201

Indicators of Compromise

Unexpected <script> tags, event handlers (onerror, onload), or javascript: URIs stored in Adobe Commerce database fields such as customer records, order comments, or product attributes
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after viewing storefront or admin pages
Session cookie or authentication token appearing in web server logs of external hosts
Unusual administrator activity, including new admin account creation, role changes, or configuration modifications not aligned with change management records

Detection Strategies

Review Adobe Commerce database tables that store user-submitted form data for encoded or raw JavaScript payloads using pattern searches for <script, onerror=, and document.cookie
Enable and audit Content Security Policy (CSP) violation reports to identify script execution attempts that deviate from allowed sources
Correlate web application firewall (WAF) logs with backend storage writes to identify submissions containing XSS payload signatures

Monitoring Recommendations

Monitor administrator sessions for anomalous XHR or fetch requests initiated from Adobe Commerce admin pages
Track access patterns to /admin endpoints for signs of session replay from unexpected IP addresses or user agents
Alert on newly created administrator accounts, permission escalations, or changes to payment configuration modules

How to Mitigate CVE-2026-76201

Immediate Actions Required

Apply the patches referenced in Adobe Security Bulletin APSB26-138 to all affected Adobe Commerce, Commerce B2B, and Magento Open Source instances
Audit stored data in customer, order, and product tables for existing XSS payloads and sanitize or purge suspicious entries
Rotate administrator credentials and invalidate active sessions if evidence of exploitation is discovered

Patch Information

Adobe has published fixes in security bulletin APSB26-138. Administrators should upgrade to the patched releases indicated by Adobe for their specific version branch. Consult the Adobe Security Bulletin APSB26-138 for exact fixed version numbers and download instructions.

Workarounds

Deploy a web application firewall rule set that blocks HTTP request bodies containing common XSS payload patterns targeting Adobe Commerce form endpoints
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins, reducing exploitation impact
Restrict administrative interface access to trusted IP ranges or via VPN until patches are applied

bash

# Example nginx Content Security Policy header for Adobe Commerce
add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://trusted-cdn.example.com; object-src 'none'; base-uri 'self'; frame-ancestors 'self';" always;