Stored cross-site scripting in Adobe products - CVE-2026-34655
Published: May 12, 2026
Vulnerability identifier: #VU131236
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-34655
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote privileged user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Affected software
Adobe Commerce B2B
Magento Open Source
Adobe Commerce (formerly Magento Commerce)
Magento Open Source
Adobe Commerce (formerly Magento Commerce)
How to mitigate CVE-2026-34655
Install updates from vendor's website.
Adobe Commerce B2B - addressed in versions 1.3.3-p18, 1.3.4-p17, 1.4.2-p10, 1.5.2-p5, 1.5.3
Magento Open Source - addressed in versions 2.4.6-p15, 2.4.7-p10, 2.4.8-p5, 2.4.9
Adobe Commerce (formerly Magento Commerce) - addressed in versions 2.4.4-p18, 2.4.5-p17, 2.4.6-p15, 2.4.7-p10, 2.4.8-p5, 2.4.9
Magento Open Source - addressed in versions 2.4.6-p15, 2.4.7-p10, 2.4.8-p5, 2.4.9
Adobe Commerce (formerly Magento Commerce) - addressed in versions 2.4.4-p18, 2.4.5-p17, 2.4.6-p15, 2.4.7-p10, 2.4.8-p5, 2.4.9