Loading vulnerability…
Stored XSS in Adobe Commerce
CVE-2026-47994 is a stored cross-site scripting vulnerability in Adobe Commerce and related product lines. A low-privileged attacker can inject malicious script content into vulnerable form fields, where the payload is stored by the application and later rendered to other users without proper neutralization. When a victim browses to a page containing the tainted field, attacker-controlled JavaScript executes in the victim's browser within the application's security context. The issue affects Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin in the affected versions.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables execution of arbitrary JavaScript in the browser of a user viewing the affected page. This can result in session hijacking, unauthorized actions performed as the victim, access to sensitive application data exposed to the browser, and potential privilege escalation if higher-privileged users such as administrators view the malicious content. Because the script executes in the context of the vulnerable application, the scope is changed and compromise can extend beyond the attacker's original privileges.
If you can’t patch tonight, do this now.
No specific vendor workaround is described beyond updating to the newest available fixed versions. Until patching is completed, reduce exposure by restricting low-privilege content submission where feasible, limiting access to administrative interfaces, monitoring for suspicious stored content in user-editable fields, and applying defense-in-depth browser-side controls such as a restrictive Content Security Policy where compatible.
Patch, then assume compromise.
Upgrade to a fixed vendor release. Reported unaffected versions include Adobe Commerce 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, and 2.4.4-2026-jul; Adobe Commerce B2B 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, and 1.3.3-2026-jul; Magento Open Source 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, and 2.4.6-2026-jul; and Adobe Commerce Webhooks Plugin 1.21.0.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.