Cross-site scripting in Adobe products - CVE-2026-47995

Vulnerability identifier: #VU137590

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2026-47995

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to cross-site scripting (stored xss) in stored content handling when rendering stored content. A remote privileged user can inject a malicious script to escalate privileges.

This issue is specific to B2B, and user interaction is required for exploitation.

Adobe Commerce B2B
Magento Open Source
Adobe Commerce (formerly Magento Commerce)

Install security update from vendor's website.

Adobe Commerce B2B - addressed in versions 1.3.3-2026-jul, 1.3.4-2026-jul, 1.4.2-2026-jul, 1.5.2-2026-jul, 1.5.3-2026-jul
Magento Open Source - addressed in versions 2.4.6-2026-jul, 2.4.7-2026-jul, 2.4.8-2026-jul, 2.4.9-2026-jul
Adobe Commerce (formerly Magento Commerce) - addressed in versions 2.4.4-2026-jul, 2.4.5-2026-jul, 2.4.6-2026-jul, 2.4.7-2026-jul, 2.4.8-2026-jul, 2.4.9-2026-jul

• https://helpx.adobe.com/security/products/magento/apsb26-73.html
• https://helpx.adobe.com/security.html

• Multiple vulnerabilities in Adobe Commerce and Magento Open Source