Act nowDisclosed

Advisory · CVE-2026-100133

Stored cross-site scripting in Adobe Commerce can hijack a victim session

Adobe Commerce has a stored script injection flaw: an attacker can plant JavaScript in a form field and have it run in the browser of whoever views the page, with changed scope. Adobe rates it CVSS 3.1 9.3.

Advisory published October 13, 2026Independent summary
Vendor
Adobe
Product
Adobe Commerce
Identifier / CWE
CVE-2026-100133
CWE-79
Action timing
Immediate
ELI5

Explain it like I’m five

A comment-style field in the store quietly keeps whatever script an attacker types into it, then serves that script to the next shopper or admin who opens the page.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Plant the script

    An attacker submits a form field containing malicious JavaScript that Commerce stores.

  2. 02Victim views the page

    A customer or administrator opens the page that renders the stored field.

  3. 03Script runs with their session

    The script executes in the victim's browser and can act with their access or session.

What happened

Adobe disclosed CVE-2026-100133 in bulletin APSB26-153 for Adobe Commerce, Commerce B2B, and Magento Open Source. A stored cross-site scripting weakness (CWE-79) lets an attacker save script in a form field so it executes for later viewers, potentially taking over the viewer’s account or session.

Adobe’s affected data covers Commerce and Magento Open Source release lines through the September 2026 updates, with the October 2026 updates listed as unaffected. Apply the APSB26-153 update for your release line.

What to do

  1. Inventory every Adobe Commerce deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Adobe Commerce while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for stored form submissions containing script markup, unexpected admin actions, and customer reports of odd storefront behavior.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Stored XSS in a commerce platform is an admin-takeover route, not a cosmetic bug. Patch from APSB26-153 and review stored content and admin sessions.