On October 13, 2026, NVD published two Adobe CVEs with identical descriptions save for the product name: CVE-2026-100133 in Adobe Commerce and CVE-2026-106629 in Adobe Experience Manager (AEM). Two stored XSS flaws, rated 9.3.
A CRITICAL XSS is unusual. That's the interesting part.
| CVE | Product | CVSS | Vector | NVD published |
|---|---|---|---|---|
| CVE-2026-100133 | Adobe Commerce | 9.3 | AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N | 2026-10-13 |
| CVE-2026-106629 | Adobe Experience Manager | 9.3 | AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N | 2026-10-13 |
Neither is in the CISA KEV catalog as of writing.
What the Flaws Do
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. [...] Scope is changed.
An attacker plants JavaScript in a vulnerable form field. The script is stored, then runs in the browser of anyone who views the affected page. Adobe mentions takeover of the victim's account or session, potentially with elevated access.
Why an XSS Reaches 9.3
Most XSS flaws land between 5 and 7. Three parts of this vector push these higher:
PR:N: no account is needed to plant the script. A store or public site always has forms anyone can reach.S:C: the code runs in the victim's browser, outside the vulnerable component. That's the scope change — and the biggest driver of the score.C:H/I:H: Adobe rates confidentiality and integrity impact as high, not limited. That choice suggests victims can include privileged users.
That last point is the scenario to worry about. A stored XSS submitted through a public form that fires when an administrator opens the page in the back office hands an admin session to the attacker. On Commerce, that means catalog, orders, customer data and payment configuration. On AEM, published content and author accounts.
The only brake is UI:R: someone has to view the page. On a back office used every day, that's not much of a brake.
Versions
NVD publishes neither affected versions nor a fixed version for these two CVEs as of writing. Check Adobe's October security bulletins for Commerce and AEM — I won't make up a version number.
For context on last month's Adobe flaws, including a Magento entry in KEV, see the September 2026 Adobe roundup.
Detection
- Unexpected HTML or JavaScript stored in form fields (reviews, addresses, messages, profile fields, AEM content)
- Admin sessions used from an unusual IP address or browser
- Admin actions no one can account for: new admin accounts, payment settings changed, scripts added to themes or templates
- Outbound requests from admin browsers to unknown domains, if your proxy logs them
Mitigation
- Apply Adobe's fixes for Commerce and AEM once you've matched your version against the bulletins.
- Tighten the Content Security Policy on the back office and the site: with no allowed script source, an injected script has far less room.
- Isolate the back office: restrict access by IP or VPN, and give admins a dedicated browsing context.
- Search for suspicious stored content in user-supplied fields and purge it.
- If in doubt: invalidate admin sessions, rotate passwords and integration tokens, and audit recent configuration changes.
Why Monitor Your E-commerce and CMS Platforms
A stored XSS looks harmless until it runs in the right session. On a platform that handles payments and customer data, the right session is the administrator's.
With cveo.tech, inventory your Commerce and AEM instances with exact versions, and get alerted whenever a critical CVE affects them.