CVE-2026-100133: Adobe Commerce stored XSS vulnerability in form fields

CVE-2026-100133 · Severity: critical · CVSS 9.3 · Published 2026-10-13

Adobe Commerce, a widely-used e-commerce platform, contains a stored cross-site scripting (XSS) vulnerability in form field handling that could allow attackers to inject malicious scripts. When a victim visits a page containing an injected malicious field, the script executes in their browser, potentially allowing attackers to hijack their account or session and steal sensitive information.

Technologies: Adobe Commerce, Adobe Commerce B2b, Adobe Magento Open Source. Vendors: Adobe.

Quick answers

Is CVE-2026-100133 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-100133 being exploited in the wild.
How severe is CVE-2026-100133?
Critical severity, with a CVSS score of 9.3, published 13 October 2026.
Which products and versions are affected?
Adobe Commerce 2.4.9-2026-sep and earlier, 2.4.8-2026-sep and earlier, 2.4.7-2026-sep and earlier, 2.4.6-2026-sep and earlier, 2.4.5-2026-sep and earlier, 2.4.4-2026-sep and earlier; Adobe Commerce B2b 1.5.3-2026-sep and earlier, 1.5.2-2026-sep and earlier, 1.4.2-2026-sep and earlier, 1.3.3-2026-sep and earlier; Adobe Magento Open Source 2.4.9-2026-sep and earlier, 2.4.8-2026-sep and earlier, 2.4.7-2026-sep and earlier, 2.4.6-2026-sep and earlier.
Is there a fix for CVE-2026-100133?
Yes: fixed in Adobe Commerce 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-oct, 2.4.10-alpha1; Adobe Commerce B2B 1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.3-2026-oct, 1.3.4-2026-oct, 1.5.4-alpha1; Magento Open Source 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.10-alpha1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100133 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-100133?
Check whether you run Adobe Commerce, Adobe Commerce B2b or Adobe Magento Open Source at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Adobe Commerce 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-oct, 2.4.10-alpha1; Adobe Commerce B2B 1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.3-2026-oct, 1.3.4-2026-oct, 1.5.4-alpha1; Magento Open Source 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.10-alpha1

Technical details

CVE-2026-100133 is a stored XSS vulnerability (CWE-79) in Adobe Commerce that allows unauthenticated attackers to inject malicious JavaScript into vulnerable form fields. The vulnerability requires user interaction (a victim viewing the affected page) and has changed scope, with impact on both confidentiality and integrity. Fixes are available in Adobe Commerce 2.4.9-2026-oct and later, Adobe Commerce B2B 1.5.3-2026-oct and later, and Magento Open Source 2.4.9-2026-oct and later.

Affected products

  • Adobe Commerce 2.4.9-2026-sep and earlier, 2.4.8-2026-sep and earlier, 2.4.7-2026-sep and earlier, 2.4.6-2026-sep and earlier, 2.4.5-2026-sep and earlier, 2.4.4-2026-sep and earlier
  • Adobe Commerce B2B 1.5.3-2026-sep and earlier, 1.5.2-2026-sep and earlier, 1.4.2-2026-sep and earlier, 1.3.3-2026-sep and earlier
  • Adobe Magento Open Source 2.4.9-2026-sep and earlier, 2.4.8-2026-sep and earlier, 2.4.7-2026-sep and earlier, 2.4.6-2026-sep and earlier

Timeline

  • 2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.