Adobe Commerce <=2.4.9-beta1 Stored XSS in Form Fields
CVE-2026-34686 Published on May 12, 2026

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-34686 is exploitable with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Exploitation:

NONE

Automatable:

Technical Impact:

PARTIAL

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

LOW

User Interaction:

REQUIRED

Scope:

CHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

HIGH

Availability Impact:

NONE

Weakness Type

What is a XSS Vulnerability?

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE-2026-34686 has been classified to as a XSS vulnerability or weakness.

Products Associated with CVE-2026-34686

Want to know whenever a new CVE is published for Adobe products? stack.watch will email you.

Adobe Commerce

Adobe Commerce B2b

Adobe Magento Open Source

Affected Versions

Adobe Commerce:

Before and including 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 is affected.
Version 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 is unaffected.

Adobe Commerce B2B:

Before and including 1.5.3-beta1, 1.5.2-p4, 1.4.2-p9, 1.3.4-p16, 1.3.3-p17 is affected.
Version 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 is unaffected.

Adobe Magento Open Source:

Before and including 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14 is affected.
Version 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 is unaffected.

Exploit Probability

EPSS

0.40%

Percentile

32.86%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.