A stored Cross-Site Scripting vulnerability in Adobe Commerce allows high-privileged attackers to execute malicious scripts in a victim's browser, posing a significant risk of session compromise.

This vulnerability is a stored Cross-Site Scripting (XSS) flaw (CWE-79) triggered via vulnerable form fields. An attacker with high-level administrative privileges can inject malicious JavaScript that executes when a victim navigates to the affected page, facilitating session hijacking.

The vulnerability carries a CVSS score of 8.1, reflecting a high impact on confidentiality and integrity. Successful exploitation enables unauthorized actors to hijack active administrative sessions, potentially granting them full control over the e-commerce platform, access to sensitive customer data, and the ability to alter store configurations or financial transactions.

Immediate Action: Update Adobe Commerce to the patched versions: 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, or 2.4.6-p13.

Proactive Monitoring: Review administrative audit logs for suspicious activity, such as unexpected script tags or unusual modifications to form fields and configuration settings.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict XSS filtering rules to detect and block malicious payloads submitted through administrative forms.

Public Exploit Available: Unknown.

Given the severity of potential session takeover, administrators should prioritize applying the provided vendor patches immediately. If immediate patching is not feasible, restrict administrative access to trusted networks and implement rigorous monitoring of all administrative actions to detect potential script injection attempts.