by Kastro
Paper/Archive/CVE-2026-100133

CVE-2026-100133

Adobe Adobe Commerce — Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

EPSS 1%CVSS 9.3
critical.is priorityof 100
41
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 64.2.642 × 2012.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

Affected

ProductAffectedFixed inSource
Adobe Commerce≤ 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep2.4.10-alpha1,2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-octCNA
Adobe Commerce B2B≤ 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep1.5.4-alpha1,1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, 1.3.3-2026-octCNA
Magento Open Source≤ 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep2.4.10-alpha1,2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-octCNA

Scores by source

adobe (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisoryadobe.com/trust/security/products/commerce/apsb26-153.html