Adobe Commerce: Stored Cross-Site Scripting (XSS) in form fields
Summary
Adobe Commerce contains a stored Cross-Site Scripting (XSS) flaw in form fields, tracked as CVE-2026-100133 and rated Critical with CVSS 9.3 by the vendor. An attacker can store malicious JavaScript in a vulnerable field, which runs in the browser of a victim who opens the affected page, and can lead to privilege escalation and control over the victim's account or session. The attacker needs no login, but a victim must interact with the page (UI:R). Adobe reports no known exploitation. A conflicting copy of the bulletin lists a lower severity, so the score should be checked in Adobe's bulletin.
Affected
- Adobe Commerce 2.4.4-2026-sep through 2.4.9-2026-sep and earlier (per CNA record)
- Adobe Commerce B2B 1.3.3-2026-sep through 1.5.3-2026-sep and earlier
- Magento Open Source 2.4.7-2026-sep through 2.4.9-2026-sep and earlier (per CNA record; the bulletin excerpt lists 2.4.6 as affected)
Fixed in
- Adobe Commerce: 2.4.4-2026-oct, 2.4.5-2026-oct, 2.4.6-2026-oct, 2.4.7-2026-oct, 2.4.8-2026-oct, 2.4.9-2026-oct, 2.4.10-alpha1
- Adobe Commerce B2B: 1.3.3-2026-oct, 1.3.4-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.5.3-2026-oct, 1.5.4-alpha1
- Magento Open Source: 2.4.7-2026-oct, 2.4.8-2026-oct, 2.4.9-2026-oct, 2.4.10-alpha1
- Magento Open Source 2.4.6: no fixed build listed; Unknown.
Workaround
Unknown.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in this update.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- No public proof of concept found; not listed in CISA KEV.
Our recommendation
- Inventory all Adobe Commerce, Adobe Commerce B2B and Magento Open Source instances and their exact versions.
- Apply the October 2026 security update (APSB26-153) and the September hotfix for CVE-2026-75650 (APSB26-146), testing first because custom code may be affected.
- Until patched, check admin users and CMS content, blocks and email templates for injected script.
- Verify the CVSS score and affected versions in Adobe's bulletin, since a conflicting copy exists.
- Monitor for unusual admin activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-153 www.adobe.com
- NVD record CVE-2026-100133 (Vulners) vulners.com
- Strix CVE-2026-100133 www.strix.ai
- Cyber Experts: Adobe Commerce October 2026 update cyberexperts.com
- Magento APSB26-153 patch overview (Ice Cube Digital) www.icecubedigital.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:17.
Original description (NVD)
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.