Adobe Commerce is vulnerable to a stored Cross‑Site Scripting flaw that allows an attacker to inject malicious JavaScript into user‑controllable form fields. When a victim views the affected page, the injected script runs in their browser and can hijack the session or assume elevated privileges within that account. The vulnerability is classified as CWE‑79 and its effect is amplified by a scope change, making the impact broader than local possession of credentials.

Products impacted are Adobe Commerce, Adobe Commerce B2B, and Magento Open Source, all from Adobe. Version information is not specified in the advisory; any installation using the affected code base is potentially vulnerable.

The vulnerability carries a CVSS score of 9.3, indicating critical severity. The EPSS score is not available, so no current exploitation probability can be inferred, and it is not listed in CISA's KEV catalog. The attack vector is likely remote, requiring an attacker to submit malicious input to the vulnerable form field; once injected, the exploit is executed in the victim’s browser, potentially leading to account compromise. The lack of exploit data suggests the risk level remains high, but real‑world exploitation may still occur if the vulnerability remains unpatched.