Adobe has disclosed CVE-2026-91013, a critical (CVSS 9.3) stored cross-site scripting flaw in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source that could let an attacker take over a victim's account or session.
What Is It
CVE-2026-91013 is a stored cross-site scripting (XSS) vulnerability (CWE-79). An attacker can inject malicious scripts into vulnerable form fields. When a victim visits the page that contains the affected field, the script runs in their browser. That could give the attacker elevated access to, or control over, the victim's account or session. Adobe notes that the scope is changed, so the impact can reach beyond the vulnerable component itself.
Why It Matters
Adobe PSIRT scored the flaw 9.3 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N:
- Network-reachable with low attack complexity
- No privileges required to exploit
- User interaction required: a victim has to load the affected page
- High impact to confidentiality and integrity, with no availability impact
Neither the NVD record nor Adobe's bulletin, as cited below, reports exploitation in the wild or a listing in the CISA Known Exploited Vulnerabilities (KEV) catalog. Check the CISA KEV catalog directly for current status. NVD lists the record as "Awaiting Analysis."
What's Vulnerable
The CNA (Adobe) lists these releases as affected:
- Adobe Commerce: 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep and earlier
- Adobe Commerce B2B: 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep and earlier
- Magento Open Source: 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep and earlier
Patch Status
Adobe lists these releases as unaffected:
- Adobe Commerce: 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-oct
- Adobe Commerce B2B: 1.5.4-alpha1, 1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, 1.3.3-2026-oct
- Magento Open Source: 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct
Administrators should move to the matching October 2026 release for their branch and check Adobe security bulletin APSB26-153 for full guidance. The cited sources give no CISA KEV required action or due date for this CVE.