Key points
- The flaw affects Adobe Commerce and Magento Open Source versions up to 2.4.9-2026-sep.
- The National Vulnerability Database rates CVE-2026-91013 as critical with a CVSS score of 9.3.
- Attackers can potentially hijack user sessions or gain elevated access through malicious JavaScript.
Adobe Commerce and Magento Open Source installations running versions up to 2.4.9-2026-sep are affected by a critical security flaw. The National Vulnerability Database identifies this issue as CVE-2026-91013. The vulnerability allows attackers to inject malicious scripts into specific form fields on affected sites. Users who view pages containing these tainted fields may have the code executed in their browsers.
In plain English
This is a stored cross-site scripting issue, classified under CWE-79. An attacker can place harmful JavaScript into a form field that the system saves. When other visitors, including administrators, open that page, their browsers run the stolen script. This can lead to session hijacking or unauthorized account access. The scope of the impact is considered changed, meaning the consequences can be more severe than initially apparent.
The background
The flaw impacts multiple release lines. Adobe Commerce versions up to 2.4.9-2026-sep through 2.4.4-2026-sep are vulnerable. Adobe Commerce B2B versions up to 1.5.3-2026-sep through 1.3.3-2026-sep are also affected. Magento Open Source users running versions up to 2.4.9-2026-sep through 2.4.7-2026-sep face the same risk. The source material does not state whether a patch or fix exists.
What changes now
Site owners must verify their current version against the affected list immediately. If your system matches any of the listed versions, it is exposed to this critical threat. The risk remains active for all unpatched systems. Administrators should monitor their sites for unusual activity that might indicate script injection. The lack of information on a fix means exposure continues for all affected systems.
Who needs to act first
Teams usually prioritize systems with direct public internet exposure to reduce attack surface. Check whether your forms are accessible to unauthenticated users, as these are prime targets for injection. Back up your current site configuration and database before making any changes or applying temporary mitigations. Test any defensive measures in a staging environment first to ensure they do not break legitimate functionality. Focus on protecting administrative accounts, as they are high-value targets for session hijacking.
What to do and how to stay safe: Adobe Commerce
- Verify if your installation matches the affected version lists provided by the National Vulnerability Database.
- Monitor server logs and browser console errors for signs of unexpected JavaScript execution or form tampering.
- Restrict access to administrative interfaces and sensitive form fields to trusted networks or IP addresses where possible.
- Wait for the vendor to provide an official update before applying unverified third-party patches or workarounds.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific versions of Adobe Commerce are affected by CVE-2026-91013?
Adobe Commerce versions up to 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, and 2.4.4-2026-sep are affected.
Is there a fix available for this vulnerability?
The source material does not state whether a fix or patch is available.
What is the severity rating of this flaw?
The National Vulnerability Database rates CVE-2026-91013 as critical with a CVSS score of 9.3.
