CVE-2026-47999 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Commerce. It allows an attacker with high privileges to inject malicious JavaScript into form fields that are stored and later rendered in the application. When other users browse pages containing the injected content, the malicious scripts execute in their browsers, potentially compromising confidentiality and integrity. The vulnerability requires user interaction and has a scope change, indicating that the impact crosses security boundaries. The CVSS 3.1 base score is 4.8 (medium severity). No official remediation or patch information is currently available.

An attacker with high privileges can inject malicious scripts that execute in the browsers of users viewing the affected pages, potentially leading to unauthorized disclosure or modification of information (confidentiality and integrity impacts). There is no impact on availability. The vulnerability requires user interaction and affects the security scope, meaning it can affect components beyond the initial vulnerable context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privileged user access to trusted personnel only and monitor for suspicious activity related to form inputs. Avoid exposing vulnerable form fields to untrusted users. Follow Adobe's official advisories for updates.