Adobe has released a security update, APSB26-153, to address multiple vulnerabilities affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The update includes fixes for critical, high, and medium-severity security issues that could expose affected eCommerce environments to unauthorized actions and system compromise.
Adobe has assigned this update a Priority 2 rating and recommends that merchants and store administrators update their installations to the latest available versions. Although Adobe has not reported active exploitation of the vulnerabilities covered by this bulletin, applying the security updates promptly remains important for protecting affected stores.
Affected Versions
The affected versions include various releases of Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. Users running the following versions or earlier should review their installations and take the necessary action:
- Adobe Commerce: 2.4.9-2026-sep and earlier, 2.4.8-2026-sep and earlier, 2.4.7-2026-sep and earlier, 2.4.6-2026-sep and earlier, 2.4.5-2026-sep and earlier, and 2.4.4-2026-sep and earlier.
- Adobe Commerce B2B: 1.5.3-2026-sep and earlier, 1.5.2-2026-sep and earlier, 1.4.2-2026-sep and earlier, 1.3.4-2026-sep and earlier, and 1.3.3-2026-sep and earlier.
- Magento Open Source: 2.4.9-2026-sep and earlier, 2.4.8-2026-sep and earlier, 2.4.7-2026-sep and earlier, and 2.4.6-2026-sep and earlier.
The vulnerabilities affect supported installations across all listed platforms. Merchants should verify their current software versions and determine which updates apply to their environments.
Solution
Adobe has released updated versions of Adobe Commerce Adobe Commerce B2B, and Magento Open Source to address the vulnerabilities covered by APSB26-153. Merchants using affected versions should take the following steps:
- Update Adobe Commerce and Magento Open Source to the latest applicable security release listed in Adobe’s bulletin.
- Update Adobe Commerce B2B to the corresponding patched version if the B2B extension is installed.
| Product | Updated Versions | Priority |
|---|---|---|
| Adobe Commerce | 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-oct | 2 |
| Adobe Commerce B2B | 1.5.4-alpha1, 1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, 1.3.3-2026-oct | 2 |
| Magento Open Source | 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct | 2 |
- Review Adobe’s official release notes and installation instructions before applying the updates.
- Test the changes in a staging environment to identify potential compatibility issues before deploying them to production.
- Apply the separate hotfix for CVE-2026-75650 in addition to the APSB26-153 security updates, as Adobe specifically recommends.
- Review the security configuration and rotate encryption keys and associated credentials as part of the remediation process recommended by Adobe.
Applying the appropriate updates helps reduce exposure to known vulnerabilities and strengthens the security of affected eCommerce environments.
Why This Matters
The vulnerabilities addressed in APSB26-153 affect several areas of Adobe Commerce and Magento Open Source security, including code execution, authorization controls, input validation, and cross-site scripting.
The most severe issue, CVE-2026-103849, carries a CVSS base score of 10.0. It could allow unauthenticated attackers to execute arbitrary code on an affected system. Another critical vulnerability, CVE-2026-92909, affects Adobe Commerce B2B and carries a CVSS score of 9.8.
Other vulnerabilities addressed by this update could allow privilege escalation, unauthorized file system changes, or security feature bypasses. These issues may put store functionality, sensitive information, and administrative controls at risk if left unaddressed.
Adobe has stated that it is not aware of active exploitation of the vulnerabilities covered by APSB26-153. However, promptly applying the available security updates is still important to reduce potential exposure and maintain a secure eCommerce environment.
Vulnerability Details
Adobe Security Bulletin APSB26-153 covers multiple vulnerabilities across Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The reported issues include improper neutralization of special elements used in a template engine (CWE-1336), incorrect authorization (CWE-863), cross-site scripting (CWE-79), and improper input validation (CWE-20).
The vulnerabilities vary in severity and potential impact. CVE-2026-103849 is classified as critical and could result in arbitrary code execution, with a CVSS base score of 10.0. CVE-2026-92909, which affects Adobe Commerce B2B, is also critical and has a CVSS score of 9.8.
| CVE | Vulnerability Category | Impact | Severity | Authentication Required | CVSS Score | Notes |
|---|---|---|---|---|---|---|
| CVE-2026-103849 | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) | Arbitrary code execution | Critical | No | 10.0 | – |
| CVE-2026-92909 | Incorrect Authorization (CWE-863) | Arbitrary code execution | Critical | No | 9.8 | B2B |
| CVE-2026-91013 | Cross-site Scripting (Stored XSS) (CWE-79) | Privilege escalation | Critical | No | 9.3 | – |
| CVE-2026-100133 | Cross-site Scripting (Stored XSS) (CWE-79) | Privilege escalation | Critical | No | 9.3 | – |
| CVE-2026-92464 | Improper Input Validation (CWE-20) | Arbitrary code execution | Critical | Yes | 9.1 | – |
| CVE-2026-92911 | Cross-site Scripting (Stored XSS) (CWE-79) | Arbitrary code execution | High | Yes | 8.7 | – |
| CVE-2026-95631 | Improper Input Validation (CWE-20) | Arbitrary file system write | High | Yes | 8.7 | – |
| CVE-2026-92908 | Incorrect Authorization (CWE-863) | Security feature bypass | High | Yes | 8.3 | B2B |
| CVE-2026-92922 | Cross-site Scripting (Stored XSS) (CWE-79) | Privilege escalation | High | Yes | 8.1 | – |
| CVE-2026-92910 | Incorrect Authorization (CWE-863) | Security feature bypass | High | No | 7.2 | B2B |
| CVE-2026-95630 | Improper Input Validation (CWE-20) | Security feature bypass | Medium | Yes | 4.3 | – |
Additional vulnerabilities could allow attackers to escalate privileges, write arbitrary files to the file system, or bypass security features. Some issues can be exploited without authentication, while others require an authenticated user or specific user interaction.
Organizations running affected Adobe Commerce or Magento Open Source versions should review the complete bulletin to identify the vulnerabilities relevant to their installations. Applying the October security updates alongside the separately required CVE-2026-75650 hotfix can help reduce security risks and protect store operations.
