The CVSS 7.7 score for CVE-2026-48414 is misleading. The 'Scope: Changed' designation is the critical signal — it tells you this isn't a self-XSS where the attacker only harms themselves. This is a privilege escalation vector. A low-privileged user (customer, vendor, or storefront account) can inject JavaScript into a data field that Adobe Commerce's admin interface then renders for customer service representatives, administrators, or automated systems. The attacker's script reaches into contexts with higher trust — admin sessions, API tokens, admin-generated content. That boundary break is what Scope Changed captures, and it's the reason this deserves attention far beyond what a 7.7 suggests.
The 'conditions beyond attacker's control' qualifier attached to this CVE likely means the malicious payload requires a privileged user to navigate to the affected field in the admin panel. Don't mistake this for a meaningful barrier. Stored XSS is a passive attack — once planted, the attacker does nothing while victims browse normally. Admin panels are constantly navigated by support staff, automated tooling scans them, and CSRs open tickets with unusual customer data daily. The 'conditions' describe a frictionless exploitation path, not a meaningful constraint.
What should you do? First, identify which form fields accept customer input and render in admin-facing contexts — product attributes, customer notes, address fields, order comments. If any of these render in the admin panel, in transactional emails, in PDF invoices, or in export feeds, you have a lineage-two stored XSS: privilege boundary crossing, not self-contained XSS. Second, audit your email rendering pipeline. If malicious scripts survive into purchase confirmations, shipment notifications, or invoices, the blast radius extends to every customer who receives communication from the compromised account. Third, treat this as an architectural flag, not a one-off patch. Adobe Commerce's EAV data model, templating system, and adminhtml rendering pipelines continuously spawn new entry points. One patched field doesn't close the funnel — you need output encoding at every render point where customer data reaches admin contexts. Fourth, re-evaluate the severity locally. The 7.7 score assumes a constrained impact model that Scope Changed explicitly contradicts. Your risk exposure is probably higher than the base score suggests, particularly if you have vendor or reseller accounts operating alongside customer data in the same system.