CVE-2026-48413 is a stored XSS vulnerability in Adobe Commerce that enables attackers with low privileges to inject malicious JavaScript into form fields. This script executes in the context of other users viewing the affected page, potentially allowing attackers to hijack sessions or escalate privileges. The vulnerability affects the confidentiality and integrity of user data and sessions, with no known exploits in the wild as of the publication date. The CVSS v3.1 score is 8.7, indicating a high severity with network attack vector, low attack complexity, requiring low privileges and user interaction, and scope change with high confidentiality and integrity impact but no availability impact.

Successful exploitation can lead to execution of arbitrary JavaScript in the context of affected users, potentially allowing attackers to hijack user sessions, escalate privileges, or perform unauthorized actions within the victim's account. This compromises confidentiality and integrity of user data and sessions. There is no indication of availability impact or known active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been provided in the available data. Until a patch is available, users should exercise caution with untrusted input and consider applying any recommended vendor mitigations once published.