CVE-2026-47999— Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Possible ATT&CK Techniques 1AI
T1189 · Drive-by CompromiseGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-47999
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Source: NVD (National Vulnerability Database)
Vulnerability Description
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Adobe | Adobe Commerce | 0 ~ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 | - | |
| Adobe | Adobe Commerce B2B | 0 ~ 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 | - | |
| Adobe | Magento Open Source | 0 ~ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 | - | |
| Adobe | Adobe Commerce Webhooks Plugin | 0 ~ 1.20.0 | - |
II. Public POCs for CVE-2026-47999
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-47999
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-47999 (1)
Same Patch Batch · Adobe · 2026-07-14 · 88 CVEs total
| CVE-2026-48318 | 9.9 CRITICAL | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal' |
| CVE-2026-48284 | 9.6 CRITICAL | ColdFusion | Improper Input Validation (CWE-20) |
| CVE-2026-48322 | 9.6 CRITICAL | ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) |
| CVE-2026-48356 | 9.6 CRITICAL | Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434) |
| CVE-2026-48359 | 9.6 CRITICAL | Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') ( |
| CVE-2026-48259 | 9.6 CRITICAL | Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918) |
| CVE-2026-48334 | 9.3 CRITICAL | Illustrator | Improper Input Validation (CWE-20) |
| CVE-2026-48321 | 9.3 CRITICAL | ColdFusion | Incorrect Authorization (CWE-863) |
| CVE-2026-48325 | 9.3 CRITICAL | ColdFusion | Missing Authentication for Critical Function (CWE-306) |
| CVE-2026-48324 | 9.1 CRITICAL | ColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Inje |
| CVE-2026-48319 | 9.1 CRITICAL | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal' |
| CVE-2026-48358 | 9.1 CRITICAL | Adobe Commerce | Improper Encoding or Escaping of Output (CWE-116) |
| CVE-2026-48327 | 9.0 CRITICAL | ColdFusion | Incorrect Authorization (CWE-863) |
| CVE-2026-47994 | 8.7 HIGH | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) |
| CVE-2026-48310 | 8.6 HIGH | Adobe Experience Manager | Improper Limitation of a Pathname to a Restricted Directory ('P |
| CVE-2026-48350 | 8.6 HIGH | Animate | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') ( |
| CVE-2026-47988 | 8.6 HIGH | Adobe Commerce | Incorrect Authorization (CWE-863) |
| CVE-2026-48252 | 8.6 HIGH | Adobe Experience Manager | Missing Authentication for Critical Function (CWE-306) |
| CVE-2026-48275 | 8.6 HIGH | Illustrator | Untrusted Search Path (CWE-426) |
| CVE-2026-48320 | 8.5 HIGH | ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) |
Showing top 20 of 88 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Adobe Commerce
- CVE-2026-47984
Adobe Commerce | Incorrect Authorization (CWE-863) - CVE-2026-47997
Adobe Commerce | Incorrect Authorization (CWE-863) - CVE-2026-47988
Adobe Commerce | Incorrect Authorization (CWE-863) - CVE-2026-48358
Adobe Commerce | Improper Encoding or Escaping of Output (CW - CVE-2026-48356
Adobe Commerce | Unrestricted Upload of File with Dangerous
Same vendor: Adobe
- CVE-2026-48295
CAI Content Credentials | Insufficiently Protected Credentia - CVE-2026-48290
CAI Content Credentials | Server-Side Request Forgery (SSRF) - CVE-2026-48296
CAI Content Credentials | Integer Underflow (Wrap or Wraparo - CVE-2026-48357
CAI Content Credentials | Uncontrolled Resource Consumption - CVE-2026-48287
CAI Content Credentials | Untrusted Search Path (CWE-426)
Same weakness: CWE-79
- CVE-2026-62948
OpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can injec - CVE-2026-62378
RustFS Console: Critical Stored XSS in Preview Modal leading - CVE-2026-1563
Pega Platform versions 8.1.0 through 25.1.2 are affected by - CVE-2026-1562
Pega Platform versions 8.1.0 through 25.1.2 are affected by - CVE-2026-9007
Reflected XSS in HCL Notes
V. Comments for CVE-2026-47999
No comments yet