CVE-2026-47995 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Commerce. It enables a high-privileged attacker to inject malicious JavaScript into form fields that are stored and later rendered in the victim's browser. This can lead to execution of arbitrary scripts in the context of the victim's session, potentially resulting in elevated privileges or session hijacking. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity with network attack vector, low attack complexity, required high privileges, and user interaction needed. The scope is changed, meaning the impact crosses security boundaries. No vendor advisory or patch information is currently available.

Successful exploitation can lead to execution of arbitrary JavaScript in the context of other users' browsers, compromising confidentiality and integrity of user sessions and data. This may allow attackers to elevate privileges or take control of victim accounts. Availability is not affected. The vulnerability requires high privileges and user interaction to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privileged user access to trusted personnel only and monitor for suspicious activity related to form inputs. Avoid exposing vulnerable form fields to untrusted users. Follow up with Adobe for updates on patches or official mitigations.