CVE-2026-92922: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Commerce

CVE-2026-92922 is a stored XSS vulnerability in Adobe Commerce. It enables a high-privileged attacker to inject malicious JavaScript into form fields that are stored and later rendered in a victim's browser. This can result in execution of arbitrary scripts in the context of the victim's session, potentially allowing the attacker to escalate privileges or hijack user sessions. The vulnerability affects Adobe Commerce and has a CVSS 3.1 base score of 8.1, indicating high severity. The attack requires user interaction (UI:R) and privileges (PR:H), and the vulnerability impacts confidentiality and integrity with a changed scope.

Successful exploitation can lead to execution of arbitrary JavaScript in the victim's browser, which may allow the attacker to gain elevated access or control over the victim's account or session. The vulnerability affects confidentiality and integrity but does not impact availability. The scope of the vulnerability is changed, indicating that the attack crosses security boundaries.

No patch or official remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict high-privileged user access to trusted personnel and monitor for suspicious activity related to form inputs.