Act nowDisclosed

Advisory · CVE-2026-91013

Second stored cross-site scripting flaw in Adobe Commerce, also 9.3

Adobe Commerce has another stored script injection flaw in the same bulletin: script saved by an attacker runs for later page viewers with changed scope. Adobe rates it CVSS 3.1 9.3.

Advisory published October 13, 2026Independent summary
Vendor
Adobe
Product
Adobe Commerce
Identifier / CWE
CVE-2026-91013
CWE-79
Action timing
Immediate
ELI5

Explain it like I’m five

Same trap as the other Commerce XSS in this bulletin: a field remembers an attacker's script and hands it to everyone who opens the page afterwards.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Plant the script

    An attacker stores malicious JavaScript through a vulnerable form field.

  2. 02Victim views the page

    A shopper or administrator opens the affected page.

  3. 03Script runs with their session

    The script executes in the victim's browser with their access.

What happened

Adobe disclosed CVE-2026-91013 in bulletin APSB26-153 as a stored cross-site scripting vulnerability (CWE-79) in Adobe Commerce, Commerce B2B, and Magento Open Source, distinct from CVE-2026-100133 in the same bulletin.

Adobe’s affected data covers Commerce and Magento Open Source release lines through the September 2026 updates, with the October 2026 updates listed as unaffected. Apply the APSB26-153 update for your release line.

What to do

  1. Inventory every Adobe Commerce deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Adobe Commerce while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for stored form submissions containing script markup and unexpected actions taken under admin sessions.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Two stored XSS flaws in one bulletin means one patch cycle fixes both. Apply APSB26-153 and review admin activity.