CVE-2026-100133: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Commerce

CVE-2026-100133 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Commerce. It enables an attacker to inject malicious JavaScript into vulnerable form fields, which executes in the context of a victim's browser upon visiting the affected page. This can result in the attacker gaining elevated privileges or control over the victim's session or account. The vulnerability has a CVSS 3.1 base score of 9.3, indicating critical severity, with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality and integrity but no impact on availability.

Successful exploitation of this vulnerability can lead to unauthorized script execution in a victim's browser, potentially allowing attackers to hijack user sessions, steal sensitive information, or perform actions with the victim's privileges within Adobe Commerce. The scope change indicates that the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, users should exercise caution with untrusted input and consider applying any recommended temporary mitigations from Adobe once available.