CVE-2026-76200

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

• CWE-79

• https://helpx.adobe.com/security/products/magento/apsb26-138.htmlVendor Advisory

Published

Sep 8, 2026

Last Modified

Sep 9, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-76195Adobe Campaign Classic (ACC) is affected by an Improper Neut…10
• CVE-2026-76196Photoshop Mobile is affected by a Session Fixation vulnerabi…7.4
• CVE-2026-76197Adobe Campaign Classic (ACC) is affected by an Improper Neut…10
• CVE-2026-76198CAI Content Credentials is affected by an Improper Input Val…5.5
• CVE-2026-76199Photoshop Desktop is affected by an Uncontrolled Search Path…8.6
• CVE-2026-7620The Notification for Telegram plugin for WordPress is vulner…4.3
• CVE-2026-76201Adobe Commerce is affected by a stored Cross-Site Scripting …9.3
• CVE-2026-76202Adobe Commerce is affected by an Incorrect Authorization vul…8.2
• CVE-2026-76203Incorrect Behavior Order: Validate Before Canonicalize in th…5.1
• CVE-2026-76205phpMyFAQ before 4.1.7 contains a SQL injection vulnerability…8.1
• CVE-2026-76206phpMyFAQ versions before 4.1.7 fail to validate active statu…5.3
• CVE-2026-76207phpMyFAQ before 4.1.7 contains a two-factor authentication b…8.1