Urgent Patching Required for Adobe Commerce and Magento 2.4.9 to Mitigate Critical Stored XSS Risk
A severe stored cross-site scripting vulnerability in Adobe Commerce and Magento Open Source requires immediate attention to prevent session hijacking.
Key points
- The flaw carries a CVSS score of 9.3, classified as critical severity by the National Vulnerability Database.
- Attackers can inject malicious scripts into form fields to execute code in victim browsers.
- Affected products include Adobe Commerce versions up to 2.4.9 and Magento Open Source up to 2.4.9.
An attacker exploiting a critical stored cross-site scripting flaw in Adobe Commerce can gain control over user sessions and accounts. The National Vulnerability Database rates CVE-2026-91013 as critical with a CVSS score of 9.3. The vulnerability allows malicious JavaScript to execute when victims visit pages containing compromised form fields.
The weakness enables attackers to inject scripts that run in the browser of anyone viewing the affected page. According to the NVD record, this execution can lead to elevated access or full control over the victim's account or session. The scope of the vulnerability is changed, indicating a direct impact on the user's security context.
Technical Context
The flaw is categorized under CWE-79, which refers to improper neutralization of input during data storage. This specific type of stored cross-site scripting persists on the server until triggered by a user. It does not require real-time interaction with the attacker, making it particularly dangerous for e-commerce platforms where user-generated content or form submissions are common.
Affected Versions
Adobe Commerce versions up to and including 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, and 2.4.4-2026-sep are vulnerable. Adobe Commerce B2B versions up to 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, and 1.3.3-2026-sep are also affected. Magento Open Source versions up to 2.4.9-2026-sep, 2.4.8-2026-sep, and 2.4.7-2026-sep remain at risk.
What to watch
No fix has been confirmed yet in the provided source material. Organizations should monitor official Adobe security advisories for patch releases. Until an update is available, administrators must treat any unexplained script execution or session anomalies as potential indicators of compromise. Reviewing server logs for unusual form field submissions may help identify early exploitation attempts.
What made it possible
Stored cross-site scripting relies on the application saving unvalidated user input to its database. When other users later retrieve that data, the browser executes it as code. Teams usually mitigate this by enforcing strict output encoding and input validation. Check whether your platform sanitizes all form fields before storage and rendering. This weakness serves the initial access or privilege escalation stage of an intrusion, allowing attackers to bypass standard authentication controls by hijacking trusted sessions.
Background: Security advisories
Security advisories provide the technical context needed to prioritize patches. They explain the severity, affected components, and mitigation steps. Without them, teams guess which fixes matter, leaving critical gaps open to exploitation while wasting time on low-risk updates.
Read the full guide: How Security Advisories Drive Patch Decisions and Reduce Risk
What to do and how to stay safe: Adobe Commerce
- Audit all form fields on your Adobe Commerce or Magento Open Source instance for unsanitized input handling.
- Monitor browser console logs and server access patterns for signs of unexpected JavaScript execution.
- Restrict administrative access to trusted networks until a vendor patch becomes available.
- Educate staff to report any unusual behavior in user accounts or session timeouts immediately.
Step-by-step guide: How to Mitigate Cross Site Scripting: A Risk-Based Approach
General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific versions of Adobe Commerce are vulnerable to CVE-2026-91013?
Adobe Commerce versions up to 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, and 2.4.4-2026-sep are affected.
What is the severity rating of this vulnerability?
The National Vulnerability Database rates CVE-2026-91013 as critical with a CVSS score of 9.3.
Does this vulnerability affect Magento Open Source?
Yes, Magento Open Source versions up to 2.4.9-2026-sep, 2.4.8-2026-sep, and 2.4.7-2026-sep are also vulnerable.
