A stored Cross-Site Scripting vulnerability in Adobe Commerce and Magento Open Source allows high-privileged attackers to execute malicious scripts in victim browsers, potentially leading to session takeover.

This vulnerability is a stored Cross-Site Scripting (XSS) issue (CWE-79) triggered when a high-privileged attacker injects malicious JavaScript into form fields. Although the attack requires user interaction, successful execution allows the script to run within the context of a victim's browser session.

The potential for session takeover poses a significant risk to the confidentiality and integrity of administrative accounts. With a CVSS score of 8.0, this high-severity vulnerability could allow an attacker to gain unauthorized access to backend systems, potentially leading to data exfiltration or unauthorized configuration changes. The impact is exacerbated in environments where administrative sessions carry high privileges over the storefront and customer data.

Immediate Action: Update to the latest secure versions as identified by Adobe: Adobe Commerce 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, or 2.4.4-p17 (or equivalent B2B/Magento versions) to resolve the underlying flaw.

Proactive Monitoring: Review administrative access logs for unusual activity or suspicious script injections in form fields. Monitor for anomalous session behavior that may indicate unauthorized access or account compromise.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block malicious script injection attempts targeting input fields. Implement Content Security Policy (CSP) headers to restrict the sources from which scripts can be executed.

Public Exploit Available: No — no confirmed public exploit exists.

Given the potential for complete account takeover, organizations should prioritize patching their Adobe Commerce and Magento environments. Administrators must verify their current version string against the fixed releases provided by Adobe and apply the necessary updates during the next maintenance window to prevent potential exploitation.