CVE-2026-47994 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Commerce. It enables a low-privileged attacker to inject malicious JavaScript into form fields that are stored and later rendered in a victim's browser. This can result in script execution within the context of the victim's session, potentially allowing the attacker to escalate privileges or hijack the victim's account. The vulnerability has a CVSS 3.1 base score of 8.7, indicating high severity, with network attack vector, low attack complexity, low privileges required, and requiring user interaction. The scope of the vulnerability is changed, affecting confidentiality and integrity with high impact, but no impact on availability. No patch or official remediation guidance is currently provided by the vendor.

Successful exploitation can lead to execution of arbitrary JavaScript in the context of the victim's browser session, potentially allowing attackers to hijack user sessions, steal sensitive information, or perform actions with the victim's privileges. The vulnerability impacts confidentiality and integrity of user accounts but does not affect system availability. The attacker requires low privileges and user interaction to exploit the vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider implementing input validation and output encoding on affected form fields to mitigate stored XSS risks. Monitor Adobe's security advisories for updates and patches addressing this vulnerability.