Cross-site scripting in Adobe products - CVE-2026-76201

Vulnerability identifier: #VU148852

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2026-76201

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to stored cross-site scripting in Adobe Commerce and Magento Open Source when processing stored content. A remote attacker can submit crafted content to escalate privileges.

User interaction is required.

Adobe Commerce B2B
Magento Open Source
Adobe Commerce (formerly Magento Commerce)

Install security update from vendor's website.

Adobe Commerce B2B - addressed in versions 1.3.3-2026-sep, 1.3.4-2026-sep, 1.4.2-2026-sep, 1.5.2-2026-sep, 1.5.3-2026-sep
Magento Open Source - addressed in versions 2.4.7-2026-sep, 2.4.8-2026-sep, 2.4.9-2026-sep
Adobe Commerce (formerly Magento Commerce) - addressed in versions 2.4.4-2026-sep, 2.4.5-2026-sep, 2.4.6-2026-sep, 2.4.7-2026-sep, 2.4.8-2026-sep, 2.4.9-2026-sep

• https://helpx.adobe.com/security/products/magento/apsb26-138.html

• Remote code execution in Adobe Commerce and Magento Open Source