CVE-2026-76200

CVE-2026-76200 is a stored Cross-Site Scripting (CWE-79) flaw in Adobe Commerce that lets an attacker persist malicious JavaScript in vulnerable form fields. When a victim later browses to a page containing the injected field, the script executes in their browser with the CVSS scope-change (S:C) indicating the impact crosses component boundaries, such as reaching an admin or another user's session. An attacker who succeeds can gain elevated access or control over the victim's account or session, which on an e-commerce platform could mean admin panel access or compromise of customer accounts. Affected products are Adobe Commerce, Magento, and the Commerce B2B offering, with specific affected and fixed version ranges not stated in the available data. Exploitation has not been confirmed: there is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.8% chance of exploitation within 30 days.

What to do: Patch by upgrading to the release specified in Adobe's security bulletin for this CVE, prioritizing stores with internet-exposed account or checkout forms where the vulnerable fields can be populated. Until patched, restrict and sanitize input to the affected form fields and review recent admin/customer session activity for signs of hijacking. Because scope is 'changed', assume a successful injection could compromise higher-privileged sessions than the field's own context, so validate any admin accounts that interacted with attacker-modified content.