A stored Cross-Site Scripting vulnerability in Adobe Commerce and Magento Open Source allows high-privileged attackers to execute arbitrary JavaScript, potentially leading to full session hijacking.

This is a stored Cross-Site Scripting (CWE-79) vulnerability where a high-privileged attacker can inject malicious scripts into form fields. The execution occurs when a victim views the affected page, requiring user interaction to trigger the payload.

The ability to execute arbitrary JavaScript in the context of an administrative session poses a severe risk to organizational data integrity and confidentiality. Given the CVSS score of 8.1, the potential for session takeover allows an attacker to bypass authentication controls, potentially leading to unauthorized access to customer data, financial records, or configuration settings.

Immediate Action: Update Adobe Commerce, Adobe Commerce B2B, and Magento Open Source to the fixed versions listed in the vendor advisory (e.g., 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 or later).

Proactive Monitoring: Audit administrative access logs for unusual activity or suspicious script injection patterns within content management fields.

Compensating Controls: Implement strict Content Security Policy (CSP) headers to restrict the sources from which scripts can be executed, thereby limiting the impact of stored XSS.

Public Exploit Available: No (exploit_available unknown).

Organizations should prioritize the application of the provided security patches across all affected Adobe Commerce and Magento instances. Given the high severity rating, ensure that administrative access is strictly controlled and that regular audits of system configurations are performed to prevent unauthorized script injection.