CVE-2026-34655 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Commerce affecting multiple versions up to and including 2.4.9-beta1. A high-privileged attacker can exploit this flaw by injecting malicious JavaScript into vulnerable form fields, which executes in the context of other users viewing the affected page. The vulnerability impacts confidentiality and integrity but not availability, with a CVSS 3.1 base score of 4.8. No vendor-provided patch or remediation level is currently documented, and no known exploits are reported in the wild.

Successful exploitation allows a high-privileged attacker to execute arbitrary JavaScript in the browsers of users who visit the affected pages, potentially leading to data disclosure or manipulation within the context of the affected site. The impact is limited to confidentiality and integrity, with no direct availability impact. Since the attacker must have high privileges to inject the script, the risk is somewhat constrained to trusted users with elevated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high-privileged user access to trusted personnel only and monitor for suspicious activity related to form inputs. Avoid exposing vulnerable form fields to untrusted users. Follow Adobe's official communications for updates on patches or mitigations.