CVE-2026-48414 is a high severity (CVSS 7.7) stored cross-site scripting flaw in Adobe Commerce, Commerce B2B and Magento Open Source. A low-privileged user can inject scripts into form fields. Adobe fixed it in the 2026-aug update, bulletin APSB26-92. The steps below show how to check your version and what to change.
What's affected
Adobe's bulletin APSB26-92 lists these products as affected at the July 2026 security update level and earlier:
- Adobe Commerce 2.4.4 to 2.4.9, each at the 2026-jul release and earlier.
- Adobe Commerce B2B 1.3.3, 1.3.4, 1.4.2, 1.5.2 and 1.5.3, each at the 2026-jul release and earlier.
- Magento Open Source 2.4.6 to 2.4.9, each at the 2026-jul release and earlier.
The updated versions carry the 2026-aug suffix, for example 2.4.8-2026-aug. Adobe says it is not aware of any exploits in the wild for the issues addressed in this bulletin, and it rates the update priority 2.
Severity labels differ. The record scores it 7.7 (CVSS 3.1, High). Adobe's bulletin gives the same 7.7 score but labels it Critical on its own scale for this entry. Under the CVSS bands used here, 7.7 is High, so this article uses High. Use the bulletin's update priority when you schedule patching.
How to check if you're exposed
On the server, from the Magento root:
bin/magento --version
composer show magento/product-community-edition | grep versions
For Adobe Commerce the package name is magento/product-enterprise-edition. Compare the result with the 2026-aug versions in the bulletin. Adobe Commerce on cloud infrastructure may receive updates through its own process, so confirm with your platform team.
Also review stored content that low-privileged users can edit, such as form fields and customer or staff supplied text, for unexpected script content.
What to do now
- Apply the 2026-aug security update for your version line, as listed in APSB26-92.
- Read the release notes for the August 2026 security update before you deploy, and test on staging.
- Review admin and API accounts and remove permissions that are not needed.
- The bulletin covers other CVEs too, so use the one update for all of them.
Why it matters
The record lists CWE-79, cross-site scripting, in the stored form. A low-privileged attacker puts script into a form field. When another user, often a more privileged one, views the page with that field, the script runs in their browser. The scope is changed, which means the effect reaches beyond the vulnerable component to the viewer's session.
The vector notes that exploitation depends on conditions beyond the attacker's control, such as a victim visiting the right page. In commerce platforms, admin users reviewing orders or content are the typical targets. Output encoding and a strict content security policy are the standard controls. The record does not mark this CVE as known exploited.
Quick check
Why is the score only 7.7 if it can reach an admin session?
The vector rates attack complexity high and needs a victim to browse to the page, which lowers the score.
Does a content security policy help?
A strict policy can limit what injected script does. It is a layer, not a replacement for the update.
Sources
Last reviewed: 18 October 2026.
