CVE-2026-76201: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Commerce

CVE-2026-76201 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Commerce. Attackers can exploit this flaw by injecting malicious JavaScript into vulnerable form fields. When victims browse to the affected page, the injected script executes in their browsers, which may allow attackers to escalate privileges or hijack user sessions. The vulnerability has a CVSS 3.1 base score of 9.3, indicating critical impact with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high confidentiality and integrity impacts.

Successful exploitation can lead to execution of arbitrary JavaScript in the context of the victim's browser session. This may result in attackers gaining elevated access or control over the victim's account or session, compromising confidentiality and integrity of user data. Availability impact is not affected.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should apply any recommended workarounds from Adobe and exercise caution with untrusted input in form fields.