Does Your Adobe Commerce Instance Hold a Critical Stored XSS Flaw?

The short version

• A stored cross-site scripting vulnerability exists in specific versions of Adobe Commerce and Magento Open Source.
• The issue allows attackers to inject malicious scripts into vulnerable form fields on affected platforms.
• Successful exploitation could lead to elevated access or full control over a victim’s account or session.

The details

The National Vulnerability Database lists CVE-2026-100133 as a critical severity issue with a CVSS score of 9.3, according to the NVD record. This weakness, classified under CWE-79, impacts Adobe Commerce versions up to 2.4.9-2026-sep, as well as earlier 2.4.x releases down to 2.4.4-2026-sep. Adobe Commerce B2B is also affected, with versions up to 1.5.3-2026-sep and older releases down to 1.3.3-2026-sep included in the scope.

Magento Open Source users face similar exposure. Versions up to 2.4.9-2026-sep and earlier 2.4.x releases down to 2.4.7-2026-sep are listed as vulnerable in the advisory. The scope of the vulnerability is described as changed, indicating that the impact extends beyond the immediate context of the injection.

The context

The vulnerability allows an attacker to place malicious scripts into form fields that do not properly sanitize input. When a victim visits the page containing the compromised field, the browser executes the injected JavaScript. This execution can occur in the context of the victim’s session, potentially granting the attacker elevated privileges or control over the account.

Next steps

Organisations should immediately audit their Adobe Commerce and Magento Open Source installations. Teams must compare their current version numbers against the affected lists provided in the NVD record. If a system falls within the vulnerable range, isolation from untrusted network segments is advisable while a remediation plan is developed.

What defenders should look for

Security operations teams should monitor web server logs for unusual POST requests to form endpoints, particularly those containing script tags or encoded payloads. Unusual spikes in session activity or unexpected privilege escalations may indicate exploitation. Check for new JavaScript files appearing in web directories or unexpected outbound connections from web servers. Containment typically involves blocking the specific malicious payload at the WAF level and resetting affected user sessions to prevent further account takeover.

What to do and how to stay safe: Adobe Commerce

• Review web application firewall rules to block common cross-site scripting payloads targeting form fields.
• Audit recent changes to form handling logic or template files for unexpected script injections.
• Monitor authentication logs for anomalous session behaviours or privilege changes that suggest account compromise.
• Once the vendor provides an update, apply patches to all affected Adobe Commerce and Magento Open Source instances.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Magento Open Source are vulnerable to CVE-2026-100133?

Versions up to 2.4.9-2026-sep, 2.4.8-2026-sep, and 2.4.7-2026-sep are affected according to the NVD.

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates CVE-2026-100133 as Critical with a CVSS score of 9.3.

Can this flaw be used to take over user accounts?

Yes, the description states that executed scripts could potentially gain control over a victim’s account or session.