Adobe Commerce: Stored cross-site scripting enables privilege escalation
Summary
Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-92922) in form fields. An attacker with high privileges, such as an administrator, can store malicious scripts that run in the browser of a victim who opens the affected page. This can lead to privilege escalation or takeover of the victim's account or session, and the scope of the impact is changed. Adobe rates the issue High with CVSS 8.1 and reports no known exploitation in the wild.
Affected
- Adobe Commerce 2.4.4 to 2.4.9, versions labeled "2026-sep and earlier"
- Adobe Commerce B2B 1.3.3, 1.3.4, 1.4.2, 1.5.2 and 1.5.3, versions labeled "2026-sep and earlier"
- Magento Open Source 2.4.7 to 2.4.9, versions labeled "2026-sep and earlier" (the bulletin also lists 2.4.6; verify against the bulletin)
Fixed in
- Adobe Commerce: 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-oct
- Adobe Commerce B2B: 1.5.4-alpha1, 1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, 1.3.3-2026-oct
- Magento Open Source: 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct
- Also keep the hotfix for CVE-2026-75650 from the September 7, 2026 bulletin APSB26-146 installed.
Workaround
Unknown.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in APSB26-153.
- Adobe's CISA SSVC assessment: exploitation none, automatable no, technical impact total.
- No public proof of concept was found in the research.
Our recommendation
- Identify all Adobe Commerce, Adobe Commerce B2B and Magento Open Source instances and their exact versions.
- Apply the October 2026 build for each product line, and verify that the hotfix for CVE-2026-75650 is present.
- Restrict admin panel access (VPN or IP allowlist), enforce MFA for admin accounts, and reduce the number of admin users.
- Review stored content in admin-editable fields for unexpected scripts.
- Re-check the NVD record and Adobe's bulletin, since NVD analysis was still pending at publication.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-153 www.adobe.com
- ONTAP: Adobe Commerce security update APSB26-153 www.ontapgroup.com
- Safeguard: Adobe Commerce APSB26-153 analysis safeguard.sh
- Strix: CVE-2026-92922 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:13.
Original description (NVD)
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.