Adobe Commerce Stored XSS Puts Low-Privilege Attackers in Control (CVE-2026-34686)

The National Vulnerability Database has issued an advisory for CVE-2026-34686, a high-severity stored Cross-Site Scripting (XSS) vulnerability impacting multiple versions of Adobe Commerce. This flaw, rated with a CVSS score of 8.7, allows a low-privileged attacker to inject malicious scripts into vulnerable form fields.

When a victim navigates to a page containing these compromised fields, the injected JavaScript executes within their browser. This could lead to session hijacking, elevated access, or complete control over the victim’s account within the Adobe Commerce environment. The scope of this attack is significant, as a successful exploit bypasses typical access controls by leveraging the victim’s authenticated session.

Defenders must prioritize patching. This isn’t theoretical; an attacker with even minimal access could weaponize this to escalate privileges or steal sensitive data. The attacker’s calculus here is simple: find a weak link, inject code, and wait for a privileged user to trigger it, essentially turning a low-privilege entry point into a high-impact compromise.