Adobe Commerce Stored Cross-Site Scripting Vulnerability Allowing Privilege Escalation

A stored Cross-Site Scripting vulnerability has been identified in Adobe Commerce. This issue allows a high-privileged attacker to inject malicious scripts into vulnerable form fields. When a victim accesses the page containing the compromised field, the injected JavaScript could execute in their browser, potentially leading to unauthorized access or control over the victim's account or session. The vulnerability affects multiple versions of Adobe Commerce, including Adobe Commerce B2B and Magento Open Source.

Impact

Exploitation of this vulnerability could result in stored Cross-Site Scripting, allowing injected scripts to be executed in the context of the user's browser.

Remediation

Users are advised to update to the latest versions of Adobe Commerce, Adobe Commerce B2B, or Magento Open Source. Instructions for updating can be found in the Adobe Security Bulletin APSB26-73.