Adobe has disclosed CVE-2026-100133, a critical (CVSS 9.3) stored cross-site scripting flaw in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source that can let attackers take over victim accounts or sessions.
What Is It
CVE-2026-100133 is a stored cross-site scripting (XSS) vulnerability (CWE-79). Adobe says an attacker can inject malicious scripts into vulnerable form fields. The injected JavaScript then runs in the browser of any victim who visits the page that contains the vulnerable field. Adobe's description says this could give the attacker elevated access or control over the victim's account or session. The CVSS scope is "changed," meaning the impact can reach beyond the vulnerable component itself.
NVD published the record on 2026-10-13 with status "Received."
Why It Matters
Adobe scores the flaw 9.3 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. In plain terms:
- Network-reachable with low attack complexity
- No privileges required to exploit
- User interaction required: a victim has to browse to the affected page
- High impact to confidentiality and integrity, no impact to availability
Commerce platforms handle customer accounts and administrative sessions. An unauthenticated attacker who can store script in a page that privileged users view could hijack those sessions.
Exploitation status: CVE-2026-100133 is not in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm active exploitation.
What's Vulnerable
According to Adobe's affected-version data:
Adobe Commerce: 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep and earlier
Adobe Commerce B2B: 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep and earlier
Magento Open Source: 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep and earlier
Patch Status
Adobe published bulletin APSB26-153 and lists these versions as unaffected:
- Adobe Commerce: 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-oct
- Adobe Commerce B2B: 1.5.4-alpha1, 1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, 1.3.3-2026-oct
- Magento Open Source: 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct
Because the CVE is not in KEV, CISA has set no required action or due date. Administrators should move to the matching October 2026 release for their branch and check APSB26-153 for full upgrade guidance.