CVE-2026-34686— Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-34686
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Source: NVD (National Vulnerability Database)
Vulnerability Description
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Adobe Commerce 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Adobe Commerce是美国奥多比（Adobe）公司的一种面向商家和品牌的全球领先的数字商务解决方案。 Adobe Commerce 2.4.9-beta1版本、2.4.8-p4版本、2.4.7-p9版本、2.4.6-p14版本、2.4.5-p16版本、2.4.4-p17版本及之前版本存在跨站脚本漏洞，该漏洞源于存储型跨站脚本，可能导致低权限攻击者向易受攻击的表单字段注入恶意脚本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Adobe | Adobe Commerce | 0 ~ 2.4.4-p17 | - |
II. Public POCs for CVE-2026-34686
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-34686
请登录查看更多情报信息。
Same Patch Batch · Adobe · 2026-05-12 · 51 CVEs total
| CVE-2026-34659 | 9.6 CRITICAL | Adobe Connect | Deserialization of Untrusted Data (CWE-502) |
| CVE-2026-34660 | 9.3 CRITICAL | Adobe Connect | Incorrect Authorization (CWE-863) |
| CVE-2026-34653 | 8.7 HIGH | Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traver |
| CVE-2026-34644 | 7.8 HIGH | After Effects | Integer Overflow or Wraparound (CWE-190) |
| CVE-2026-34638 | 7.8 HIGH | Premiere Pro | Use After Free (CWE-416) |
| CVE-2026-34661 | 7.8 HIGH | Illustrator | Out-of-bounds Write (CWE-787) |
| CVE-2026-34675 | 7.8 HIGH | Substance3D - Painter | Out-of-bounds Write (CWE-787) |
| CVE-2026-34643 | 7.8 HIGH | After Effects | Out-of-bounds Write (CWE-787) |
| CVE-2026-34642 | 7.8 HIGH | After Effects | Heap-based Buffer Overflow (CWE-122) |
| CVE-2026-34639 | 7.8 HIGH | Media Encoder | Out-of-bounds Write (CWE-787) |
| CVE-2026-34640 | 7.8 HIGH | Media Encoder | Integer Overflow or Wraparound (CWE-190) |
| CVE-2026-34637 | 7.8 HIGH | Premiere Pro | Out-of-bounds Write (CWE-787) |
| CVE-2026-34676 | 7.8 HIGH | Substance3D - Painter | Out-of-bounds Write (CWE-787) |
| CVE-2026-34687 | 7.8 HIGH | Illustrator | Heap-based Buffer Overflow (CWE-122) |
| CVE-2026-34636 | 7.8 HIGH | Premiere Pro | Out-of-bounds Write (CWE-787) |
| CVE-2026-34683 | 7.8 HIGH | Substance3D - Designer | Out-of-bounds Write (CWE-787) |
| CVE-2026-34684 | 7.8 HIGH | Substance3D - Designer | Out-of-bounds Write (CWE-787) |
| CVE-2026-34681 | 7.8 HIGH | Substance3D - Designer | Out-of-bounds Write (CWE-787) |
| CVE-2026-34682 | 7.8 HIGH | Substance3D - Designer | Out-of-bounds Write (CWE-787) |
| CVE-2026-34690 | 7.8 HIGH | After Effects | Stack-based Buffer Overflow (CWE-121) |
Showing top 20 of 51 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Adobe Commerce
- CVE-2026-34656
Adobe Commerce | Improper Authorization (CWE-285) - CVE-2026-34658
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) - CVE-2026-34650
Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) - CVE-2026-34647
Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918 - CVE-2026-34685
Adobe Commerce | Improper Input Validation (CWE-20)
Same vendor: Adobe
- CVE-2026-34672
CAI Content Credentials | Integer Underflow (Wrap or Wraparo - CVE-2026-34671
CAI Content Credentials | Integer Overflow or Wraparound (CW - CVE-2026-34669
CAI Content Credentials | Improper Input Validation (CWE-20) - CVE-2026-34678
CAI Content Credentials | Uncontrolled Resource Consumption - CVE-2026-34688
CAI Content Credentials | Improper Input Validation (CWE-20)
Same weakness: CWE-79
- CVE-2026-44549
Open WebUI: Stored XSS in excel file preview - CVE-2026-45299
Open WebUI: Stored Cross-Site Scripting In Profile Picture - CVE-2026-45665
Open WebUI: Stored XSS in Banner Component via Improper Sani - CVE-2026-45318
Open WebUI: Stored XSS via unsanitized Office/Excel/DOCX fil - CVE-2026-45315
Open WebUI: Stored XSS via attacker-controlled file extensio
V. Comments for CVE-2026-34686
No comments yet