External risk intelligence

Adobe Commerce Stored XSS Vulnerability Allows Malicious Script Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-91013

Adobe Commerce is an e-commerce platform designed to be a public-facing web application. Since it is intended to host storefronts accessible to customers over the internet, the form fields within the application are commonly exposed to public web traffic.

Cross-site Scripting

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in Adobe Commerce could allow attackers to inject malicious scripts into websites, potentially leading to unauthorized access or control of user accounts and sessions. This issue impacts the security of e-commerce platforms, making it important to understand its potential reach and impact.

Malicious scripts can be inserted into web forms.
Protects customer accounts and session integrity.
Confirm relevance and exposure for Adobe Commerce.

Attack Path

How an attacker could exploit the issue

An attacker could inject malicious scripts into vulnerable form fields within Adobe Commerce. When a victim visits a page containing these fields, the embedded JavaScript could execute in their browser, potentially leading to unauthorized access or control of the victim's account.

No authentication required to start.
Malicious scripts in form fields.
Session hijacking or account takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact Adobe Commerce by allowing an attacker to inject malicious scripts into form fields. When a victim views a page with the compromised field, these scripts may execute in their browser, potentially leading to unauthorized access or control of the victim's account or session.

User session data.
Malicious scripts injected into form fields.
Unauthorized account access or control.

Operational Fix

Recommended remediation, mitigation, and detection steps

Adobe Commerce, being a public-facing e-commerce platform, requires immediate attention from application owners, platform teams, and potentially vendor management to mitigate risks associated with this stored Cross-Site Scripting vulnerability. The first practical step involves identifying all instances of Adobe Commerce, assessing their internet reachability and business criticality, and confirming the accountable owner for each. Once identified and prioritized, a remediation plan can be developed, which may include coordinated patching, vendor engagement, or temporary risk-reduction measures.

Application owners and platform teams should lead.
Verify public-facing instances and criticality first.
Plan coordinated remediation or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Adobe Commerce?

Adobe Commerce is a comprehensive e-commerce platform that businesses use to build and manage online storefronts. It provides the core architecture for digital shopping experiences, handling everything from product catalogs to user account management and payment processing for customers across the internet.

What is the vulnerability in CVE-2026-91013?

This CVE involves a stored Cross-Site Scripting (XSS) weakness, categorized as CWE-79. In plain terms, the application fails to properly sanitize user-provided data in certain form fields. This allows an attacker to save malicious JavaScript code on the server, which then runs automatically in the browsers of other users who view that specific page later.

How does an attacker trigger this XSS issue?

An attacker triggers this by submitting malicious scripts into specific, vulnerable form fields within the application. Notably, this process does not require the attacker to have an existing user account or elevated privileges to input the script. The vulnerability is not triggered by simply browsing the site, but rather by the successful storage of malicious code within the form fields themselves.

Is my Adobe Commerce instance at risk?

Because Adobe Commerce is designed as a public-facing web application, Halo Surface Signal identifies it as highly likely to be exposed to internet traffic. Since these forms are meant to interact with customers, any instance reachable from the public web should be considered relevant and potentially accessible to outside actors.

What should I do if I run Adobe Commerce?

Begin by creating a complete inventory of all your Adobe Commerce instances to determine which are reachable from the internet. Once you have identified these systems, assess their business importance to prioritize your response. Engage your platform and security teams to track the official vendor guidance and prepare to implement necessary security updates or risk-mitigation measures.

References

www.adobe.com/trust/security/products/commerce/apsb26-153.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.