Adobe Commerce stored cross-site scripting lets low-privileged attackers take over accounts (CVE-2026-92911)

What happened

Adobe Commerce is affected by a stored cross-site scripting (XSS) vulnerability. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. When a victim later browses to the page containing the field, the script runs in the victim's browser. Adobe describes the potential result as elevated access or control over the victim's account or session.

The CVSS 3.1 vector indicates the attack is reachable over the network with low complexity, requires low privileges and some user interaction, and has changed scope with high confidentiality and integrity impact; availability is not affected. At the time of writing, the CVE record does not report public disclosure or active exploitation.

Who is affected

Adobe Commerce versions up to and including 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep and 2.4.4-2026-sep are affected. Adobe Commerce B2B versions up to and including 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep and 1.3.3-2026-sep are affected. Magento Open Source versions up to and including 2.4.9-2026-sep, 2.4.8-2026-sep and 2.4.7-2026-sep are affected. Commerce and Magento are public-facing e-commerce platforms, and affected deployments are storefront and admin installations on those version lines.

What to do now

1. Apply the fixed release for your product. Adobe has published the October 2026 builds: Adobe Commerce 2.4.4-2026-oct, 2.4.5-2026-oct, 2.4.6-2026-oct, 2.4.7-2026-oct, 2.4.8-2026-oct, 2.4.9-2026-oct and 2.4.10-alpha1; Adobe Commerce B2B 1.5.4-alpha1, 1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct and 1.3.3-2026-oct; Magento Open Source 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct and 2.4.7-2026-oct.
2. Prioritise storefronts and admin access; a compromised admin session can provide elevated control.
3. No workaround is listed for this CVE. Until the update is applied, restrict low-privileged content entry and review stored fields.

How to detect it

No vendor indicators of compromise are listed for this CVE. As a practical check, review stored form fields and user-generated content for unexpected JavaScript or HTML, and investigate elevated admin session activity that cannot be explained.

Beyond the patch

Stored XSS in an e-commerce platform is a reminder that the code rendering customer and low-privileged input is part of the attack surface. A penetration test and hardening review can show where stored fields can be abused, and supply-chain defence tracking keeps Adobe's patch cycle visible across every Commerce or Magento installation you run.