CVE-2026-48371

No fix known EPSS <1%CVSS 5.4

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

Published 2026-07-14 · CVE record · OSV

Products: Adobe Commerce, Adobe Commerce B2B, adobe magento_open_source, Adobe Commerce Events