CVE-2026-47994 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Commerce. It enables a low-privileged attacker to inject malicious JavaScript into vulnerable form fields. When a victim views the affected page, the script executes in their browser, potentially allowing the attacker to escalate privileges or hijack the victim's session. The vulnerability has a CVSS v3.1 base score of 8.7, indicating high severity, with network attack vector, low attack complexity, requiring privileges, user interaction, and scope change. No patch or official remediation guidance is currently provided by the vendor.

Successful exploitation can lead to execution of arbitrary JavaScript in the context of the victim's browser session, potentially resulting in account takeover or session hijacking. The vulnerability affects confidentiality and integrity with high impact, but does not affect availability. The scope of the vulnerability is changed, indicating impact beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to vulnerable form fields and applying web application firewall (WAF) rules to detect and block malicious input patterns related to XSS. Avoid relying on client-side mitigations alone.