Adobe Commerce stored XSS lets high-privileged attackers run scripts in victims' browsers (CVE-2026-92922)

What happened

Adobe Commerce is affected by a stored cross-site scripting vulnerability in vulnerable form fields. A high-privileged attacker can inject malicious JavaScript into those fields. When a victim later browses to the page containing the field, the script runs in the victim's browser.

The CVE record describes the impact as potentially gaining elevated access or control over the victim's account or session. The CVSS vector shows a network attack with low complexity. The attacker needs high privileges, and a victim must visit the affected page for the script to execute; scope is changed. Confidentiality and integrity impacts are high, with no availability impact. Exploitation is not currently listed in CISA's KEV catalogue, and the CVE record does not state that it has been publicly disclosed.

Who is affected

These are Adobe Commerce and Magento Open Source e-commerce platforms. Affected releases are:

• Adobe Commerce up to and including 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep and 2.4.4-2026-sep.
• Adobe Commerce B2B up to and including 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep and 1.3.3-2026-sep.
• Magento Open Source up to and including 2.4.9-2026-sep, 2.4.8-2026-sep and 2.4.7-2026-sep.

If you run a shop on these releases, the September 2026 builds are affected; fixed builds are listed below.

What to do now

1. Identify your edition and current version; the affected releases are the September 2026 builds above.
2. Apply the fixed release for your track:

• Adobe Commerce: 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-oct.
• Adobe Commerce B2B: 1.5.4-alpha1, 1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, 1.3.3-2026-oct.
• Magento Open Source: 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct.

1. The CVE record does not list a workaround. Until you can patch, restrict access to the administration roles that can edit the vulnerable form fields and monitor affected pages for unexpected scripts.

Beyond the patch

Apply the patch first. Beyond this release, a stored XSS in an e-commerce platform is a reminder that a public shop's admin and content roles are a security boundary. Implementation & Assessment Services can test the public site and the privileged workflows that edit form fields, and Supply Chain Defense & Third-Party Risk helps track Adobe Commerce and other platform update cycles across your estate so the next patch is planned rather than reactive.