CVE-2026-34686 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Commerce affecting versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17, and earlier. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields, which executes in the context of a victim's browser upon visiting the affected page. This can lead to elevated access or control over the victim's account or session. The vulnerability has a CVSS 3.1 base score of 8.7, indicating high severity. The scope is changed, meaning the vulnerability affects resources beyond the attacker’s privileges. No patch or official remediation level is currently documented.

Successful exploitation allows an attacker with low privileges to inject persistent malicious scripts that execute in the browsers of users who visit the affected pages. This can lead to account compromise or session hijacking, potentially resulting in unauthorized access or control over victim accounts. The vulnerability does not impact availability but has high confidentiality and integrity impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to vulnerable form fields and applying web application firewall (WAF) rules to detect and block suspicious input patterns related to XSS. Monitor Adobe's security advisories closely for updates and apply patches promptly once available.