CVE-2026-34655 is a stored Cross-Site Scripting (CWE-79) vulnerability affecting Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17, and earlier. A high-privileged attacker can inject malicious scripts into vulnerable form fields, which execute when other users browse the affected pages. The vulnerability impacts confidentiality and integrity with a medium severity CVSS score of 4.8. No patch or official fix has been documented in the provided data.

Successful exploitation could allow a high-privileged attacker to execute arbitrary JavaScript in the context of users viewing the vulnerable form fields, potentially leading to theft of sensitive information or session hijacking. The impact is limited by the requirement for high privileges to inject the malicious script and user interaction to trigger execution. There is no indication of availability impact or known active exploitation.

Patch status is not yet confirmed — check the Adobe advisory for current remediation guidance. Until a fix is available, restrict high-privileged user access to trusted personnel only and monitor for suspicious activity related to form inputs. Avoid exposing vulnerable form fields to untrusted users. Follow Adobe's official channels for updates on patches or mitigations.