CVE-2026-47999 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Commerce. It allows an attacker with high privileges to inject malicious JavaScript into form fields that are stored and later rendered in the application. When other users access the affected pages, the malicious script executes in their browsers, potentially compromising confidentiality and integrity of data. The vulnerability requires user interaction and has a medium attack complexity. No vendor advisory or patch information is currently provided.

The vulnerability can lead to execution of arbitrary JavaScript in the context of affected users' browsers, potentially exposing sensitive information or enabling actions on behalf of those users. The impact affects confidentiality and integrity but does not affect availability. Exploitation requires high privileges and user interaction, limiting the scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privileged user access and carefully validate and sanitize inputs in form fields to reduce risk.