CVE-2026-34658 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17, and earlier. A high-privileged attacker can inject malicious scripts into vulnerable form fields, causing the scripts to execute in the browsers of users who access those pages. The vulnerability affects the confidentiality and integrity of user interactions but does not impact availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

Successful exploitation allows a high-privileged attacker to execute arbitrary JavaScript in the context of affected users' browsers, potentially leading to information disclosure or session manipulation. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires high privileges and user interaction, reducing the likelihood of widespread exploitation. No known active exploits have been reported.

Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. Until an official fix is released, restrict high-privileged user access to trusted personnel only and monitor for suspicious activity involving form inputs. Avoid exposing vulnerable form fields to untrusted users. Follow Adobe's updates closely for any released patches or mitigation instructions.