A stored Cross-Site Scripting vulnerability in Adobe Commerce and Magento Open Source allows high-privileged attackers to execute malicious scripts in a victim's browser, potentially leading to session takeover.

This is a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) where a high-privileged attacker can inject malicious JavaScript into form fields. The script executes when an unsuspecting victim interacts with the compromised page, potentially leading to full session hijacking.

The ability for an attacker to perform session takeover poses a significant risk to organizational data integrity and confidentiality. With a CVSS score of 8.1, this vulnerability is classified as High severity, as it allows attackers to impersonate administrative or high-privileged users, potentially leading to further unauthorized system access or data exfiltration.

Immediate Action: Upgrade to the latest secure versions as provided in the vendor security bulletin (APSB26-05), specifically targeting versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, or 2.4.4-p17 for Adobe Commerce.

Proactive Monitoring: Review administrative audit logs for suspicious activity, particularly changes to form fields or unusual script injections within the application interface.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) configured to detect and block common XSS patterns in form submissions.

Public Exploit Available: Unknown.

Given the potential for session hijacking, organizations should treat this vulnerability with urgency. Administrators must verify their current version against the fixed releases provided by Adobe and schedule an immediate maintenance window to apply the necessary security patches. Maintaining rigorous access controls for high-privileged accounts remains the most effective defense against this attack vector.