Adobe Commerce patches multiple high-severity flaws
Adobe fixed eight vulnerabilities in Adobe Commerce including stored XSS, authorization bypass, and path traversal issues, some remotely exploitable without interaction.
NCSC-NL published an advisory summarizing Adobe's patches for eight vulnerabilities in Adobe Commerce. The flaws span stored Cross-Site Scripting (XSS), where attackers could inject malicious JavaScript into form fields to hijack sessions or escalate privileges in a victim's browser context, and multiple incorrect authorization issues that allow privilege escalation, unauthorized access to sensitive information, and security control bypass without requiring user interaction. A path traversal vulnerability was also identified that lets high-privileged attackers bypass security mechanisms to access files or directories outside the intended scope.
All eight CVEs are specific to Adobe Commerce and can reportedly be exploited remotely. Several carry high CVSS v3 scores (up to 9.3), and some vulnerabilities may cause limited disruption to service availability. There is no indication in the advisory of active in-the-wild exploitation; this is a vendor patch release rather than a report of confirmed attacks. Defenders running Adobe Commerce should prioritize applying the vendor-issued updates referenced in the advisory, particularly for the two 9.3-rated authorization/XSS issues, and review access logs for anomalous admin-level file access or unexpected script execution in storefront form fields.
Mentioned in this report
Detection guidance
Adobe Commerce Stored XSS via Form Field Injection
Detects POST requests to Adobe Commerce storefronts with script tags or event handlers in form field parameters, indicative of stored XSS payload injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Commerce Stored XSS via Form Field Injection
description: Detects POST requests to Adobe Commerce endpoints containing JavaScript
payloads (script tags, event handlers) in form field parameters. Typical stored
XSS exploitation pattern targeting session hijacking or privilege escalation.
tags:
- attack.execution
- attack.t1059.007
logsource:
category: proxy
product: http
detection:
selection:
http_method: POST
uri|contains:
- /customer/account/
- /checkout/
- /contact/
- /review/
http_body|re:
- (script>|on\w+\s*=|javascript:|onerror|onload)
filter_legitimate:
http_body|contains:
- 'content-type: application/json'
- __VIEWSTATE
condition: selection and not filter_legitimate
falsepositives:
- Security testing tools scanning for XSS vulnerabilities
- WAF log noise from automated scanners
level: high
id: 2acae975-41d1-5d2c-8185-e0951290648a
status: experimental
author: Vorant
Adobe Commerce Privilege Escalation via Authorization Bypass
Detects HTTP requests to Adobe Commerce admin endpoints from non-admin user sessions or requests modifying authorization roles without prior elevation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Commerce Privilege Escalation via Authorization Bypass
description: Detects POST/PUT requests to Adobe Commerce admin API endpoints (roles,
permissions, customer groups) by sessions lacking admin privileges or direct permission
modifications in request body. Indicates authorization bypass exploitation.
tags:
- attack.privilege-escalation
- attack.t1078
logsource:
category: proxy
product: http
detection:
selection:
http_method:
- POST
- PUT
uri|re:
- /admin/user/role
- /admin/customer/group
- /rest/.*/(customer|admin)/
http_body|contains:
- is_active":1
- '"role_id"'
- '"permission'
filter_admin_session:
http_headers|contains: 'X-Requested-With: XMLHttpRequest'
condition: selection and not filter_admin_session
falsepositives:
- Legitimate admin role provisioning workflows
- Third-party integration tools managing customer groups via API
level: high
id: 14e7d6a0-ebbb-59d5-af4e-163504baa037
status: experimental
author: Vorant
Adobe Commerce Path Traversal File Access
Detects HTTP requests to Adobe Commerce containing path traversal sequences (.., ../, encoded variants) targeting file system paths or directory enumeration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Commerce Path Traversal File Access
description: Detects GET/POST requests to Adobe Commerce endpoints containing directory
traversal patterns (../, ..\\, URL-encoded variants) or file system path revelation
attempts. Exploits CVE-2024 path traversal to bypass file scope restrictions.
tags:
- attack.discovery
- attack.t1083
logsource:
category: proxy
product: http
detection:
selection:
http_method:
- GET
- POST
uri|re:
- (\.\./|\.\.%2f|\.\.%5c|%2e%2e)
filter_scanner_testing:
user_agent|contains:
- Nessus
- Acunetix
- Burp
- OpenVAS
condition: selection and not filter_scanner_testing
falsepositives:
- Legitimate file serving endpoints with versioning or archive retrieval
- Security scanning by authorized penetration testing
level: medium
id: a7cc4da9-dd73-55e1-9574-792c22f32335
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0361.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free