CVE-2026-48414 is a stored XSS vulnerability in Adobe Commerce that permits a low-privileged attacker to inject malicious JavaScript into vulnerable form fields. This script executes in the context of a victim's browser when they access the affected page, potentially allowing the attacker to escalate privileges or hijack user sessions. The vulnerability's exploitation depends on factors outside the attacker's direct control, and it changes the security scope. The CVSS v3.1 score is 7.7, indicating high severity, with attack vector network, high attack complexity, low privileges required, user interaction required, and scope changed. Confidentiality and integrity impacts are high, with no impact on availability.

Successful exploitation can lead to execution of arbitrary JavaScript in the victim's browser, potentially resulting in elevated access or control over the victim's account or session within Adobe Commerce. This compromises confidentiality and integrity of user data. There is no reported impact on system availability. The attack requires user interaction and conditions beyond the attacker's control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published at this time. Until a patch is available, users should monitor Adobe's advisories for updates and consider applying any recommended mitigations once released.