Adobe has disclosed a critical stored cross-site scripting flaw (CVSS 9.3) in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source that can allow an unauthenticated attacker to plant malicious JavaScript in vulnerable form fields and, per Adobe's own impact description, potentially take over the sessions of users who later view them.
What Is It
CVE-2026-76200 is a stored cross-site scripting vulnerability (CWE-79) in Adobe Commerce. An attacker can inject malicious scripts into vulnerable form fields; that JavaScript is then executed in a victim's browser when the victim browses to the page containing the field. Per Adobe, successful exploitation can result in the attacker "potentially gaining elevated access or control over the victim's account or session."
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, network attack vector, low complexity, no privileges required, and a changed scope, meaning the impact extends beyond the vulnerable component. User interaction is required: someone must load the poisoned page. Base score is 9.3 (CRITICAL) with a 5.8 impact subscore against high confidentiality and integrity impact; availability is unaffected.
Why It Matters
The combination of no required privileges and changed scope is what pushes a stored XSS bug into critical territory. The injected payload persists server-side, so it can fire against visitors who load the affected page rather than requiring the attacker to re-engage each target. That means a single successful injection may be leveraged repeatedly against administrators or customers of an e-commerce storefront; an environment where session takeover translates directly into access to order, customer, and payment workflows. Adobe has not published exploitation details, so the practical reach of any given injection will depend on which fields are affected and who renders them.
As of this writing, CVE-2026-76200 does not appear in CISA's Known Exploited Vulnerabilities catalog. There is accordingly no confirmation of active exploitation and no federal remediation deadline associated with this CVE, though absence from KEV reflects only what CISA has catalogued to date, not evidence that exploitation is not occurring.
What's Vulnerable
- Adobe Commerce: 2.4.9, 2.4.8, 2.4.7, 2.4.6, 2.4.5, and 2.4.4 lines, up to and including the
2026-augreleases. - Adobe Commerce B2B: 1.5.3, 1.5.2, 1.4.2, 1.3.4, and 1.3.3 lines, up to and including the
2026-augreleases. - Magento Open Source: 2.4.9, 2.4.8, 2.4.7, and 2.4.6 lines, up to and including the
2026-augreleases.
Patch Status
Fixed builds are available. Adobe lists the 2026-sep releases as unaffected: Adobe Commerce 2.4.9/2.4.8/2.4.7/2.4.6/2.4.5/2.4.4-2026-sep, Adobe Commerce B2B 1.5.3/1.5.2/1.4.2/1.3.4/1.3.3-2026-sep, and Magento Open Source 2.4.9/2.4.8/2.4.7-2026-sep. Note that Magento Open Source 2.4.6 appears in the affected list without a corresponding unaffected 2026-sep build. Upgrade to the September 2026 release for your branch; details are in Adobe's advisory APSB26-138.
The record was published 2026-09-08 and remains in "Undergoing Analysis" status at NVD, so enrichment such as CPE data may change.
Sources
- Adobe Security Bulletin APSB26-138; https://helpx.adobe.com/security/products/magento/apsb26-138.html
- NVD, CVE-2026-76200, https://nvd.nist.gov/vuln/detail/CVE-2026-76200
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog