Cross-site scripting in Adobe products - CVE-2026-47999

Vulnerability identifier: #VU137595

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2026-47999

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to cross-site scripting (stored xss) in stored content handling when rendering stored content. A remote privileged user can inject a malicious script to execute arbitrary code.

User interaction is required for exploitation.

Adobe Commerce B2B
Magento Open Source
Adobe Commerce (formerly Magento Commerce)

Install security update from vendor's website.

Adobe Commerce B2B - addressed in versions 1.3.3-2026-jul, 1.3.4-2026-jul, 1.4.2-2026-jul, 1.5.2-2026-jul, 1.5.3-2026-jul
Magento Open Source - addressed in versions 2.4.6-2026-jul, 2.4.7-2026-jul, 2.4.8-2026-jul, 2.4.9-2026-jul
Adobe Commerce (formerly Magento Commerce) - addressed in versions 2.4.4-2026-jul, 2.4.5-2026-jul, 2.4.6-2026-jul, 2.4.7-2026-jul, 2.4.8-2026-jul, 2.4.9-2026-jul

• https://helpx.adobe.com/security/products/magento/apsb26-73.html
• https://helpx.adobe.com/security.html

• Multiple vulnerabilities in Adobe Commerce and Magento Open Source