On October 13, 2026, Adobe released a security update, APSB26-153, for Adobe Commerce and Magento Open Source. The update addresses vulnerabilities rated critical, high, and medium that could lead to arbitrary code execution, privilege escalation, arbitrary file system writes, and security feature bypasses.
Adobe has assigned the update a Priority 2 rating. Although Adobe reports no known exploitation in the wild for the vulnerabilities addressed by APSB26-153, merchants should review their installed versions and apply the relevant security fixes.
The update also covers Adobe Commerce B2B. Adobe recommends applying the October security fixes along with the separate hotfix for CVE-2026-75650.
Who is at Risk? (Affected Versions)
According to Adobe, the following versions are affected by APSB26-153. Check your installed version against the list to determine whether your store requires the update.
| Product | Affected Versions |
|---|---|
| Adobe Commerce | 2.4.9-2026-sep and earlier, 2.4.8-2026-sep and earlier, 2.4.7-2026-sep and earlier, 2.4.6-2026-sep and earlier, 2.4.5-2026-sep and earlier, 2.4.4-2026-sep and earlier |
| Magento Open Source | 2.4.9-2026-sep and earlier, 2.4.8-2026-sep and earlier, 2.4.7-2026-sep and earlier, 2.4.6-2026-sep and earlier |
| Adobe Commerce B2B | 1.5.3-2026-sep and earlier, 1.5.2-2026-sep and earlier, 1.4.2-2026-sep and earlier, 1.3.4-2026-sep and earlier, 1.3.3-2026-sep and earlier |
Critical Vulnerabilities Explained
APSB26-153 addresses 11 vulnerabilities across critical, high, and medium severity levels. The reported impacts include arbitrary code execution, privilege escalation, arbitrary file system writes, and security feature bypasses.
The table below lists the vulnerability categories, impacts, severity ratings, CVSS scores, authentication requirements, and CVE references published by Adobe.
| Vulnerability Type | Potential Impact | Severity | CVSS | Requires Authentication? | CVE Reference |
|---|---|---|---|---|---|
| Template engine input neutralization | Arbitrary code execution | Critical | 10.0 | No | CVE-2026-103849 |
| Incorrect authorization (B2B) | Arbitrary code execution | Critical | 9.8 | No | CVE-2026-92909 |
| Stored XSS | Privilege escalation | Critical | 9.3 | No | CVE-2026-91013 |
| Stored XSS | Privilege escalation | Critical | 9.3 | No | CVE-2026-100133 |
| Improper input validation | Arbitrary code execution | Critical | 9.1 | Yes | CVE-2026-92464 |
| Stored XSS | Arbitrary code execution | High | 8.7 | Yes | CVE-2026-92911 |
| Improper input validation | Arbitrary file system write | High | 8.7 | Yes | CVE-2026-95631 |
| Incorrect authorization (B2B) | Security feature bypass | High | 8.3 | Yes | CVE-2026-92908 |
| Stored XSS | Privilege escalation | High | 8.1 | Yes | CVE-2026-92922 |
| Incorrect authorization (B2B) | Security feature bypass | High | 7.2 | No | CVE-2026-92910 |
| Improper input validation | Security feature bypass | Medium | 4.3 | Yes | CVE-2026-95630 |
Key Risks
- Arbitrary code execution: CVE-2026-103849 has a CVSS score of 10.0 and does not require authentication, according to Adobe. CVE-2026-92909 is another critical code execution vulnerability affecting Adobe Commerce B2B.
- Stored cross-site scripting (XSS): CVE-2026-91013 and CVE-2026-100133 are critical vulnerabilities associated with privilege escalation. Adobe also lists high-severity XSS vulnerabilities under CVE-2026-92911 and CVE-2026-92922.
- Incorrect authorization: The B2B-related vulnerabilities CVE-2026-92908 and CVE-2026-92910 can result in security feature bypasses.
- Arbitrary file system writes: CVE-2026-95631 is a high-severity vulnerability with a CVSS score of 8.7.
- Improper input validation: CVE-2026-92464 can lead to arbitrary code execution, while CVE-2026-95630 can result in a security feature bypass.
These descriptions reflect the categories, impacts, and severity ratings published in Adobe’s bulletin. They do not imply that every vulnerability can be exploited without authentication.
October 2026 Security Updates
Adobe lists the following updated versions for APSB26-153.
| Product | Updated Version (October 2026 Release) |
|---|---|
| Adobe Commerce | 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-oct |
| Magento Open Source | 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct |
| Adobe Commerce B2B | 1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, 1.3.3-2026-oct |
Adobe also lists 2.4.10-alpha1 for Adobe Commerce and Magento Open Source, and 1.5.4-alpha1 for Adobe Commerce B2B. Adobe identifies 2.4.10-alpha1 as the first alpha release in the 2.4.10 release line.
Important note on APSB26-146:
On September 7, 2026, Adobe released security bulletin APSB26-146 to address CVE-2026-75650. Adobe’s October security update guidance instructs merchants to apply the CVE-2026-75650 hotfix in addition to the October security fixes.
Adobe also recommends rotating encryption keys and associated credentials as part of the remediation process.
Action Plan – How to Apply the Security Update
Adobe provides October 2026 isolated security patches for the affected release lines. The appropriate patch and application process depend on your installed version and deployment type.
1. Check Your Magento Version
Identify your current Adobe Commerce or Magento Open Source version and check it against Adobe’s affected-version list. If you use Adobe Commerce B2B, check the installed B2B version as well.
2. Apply the Correct October Security Patch
Adobe provides isolated security patch files for the affected release lines. The available files include:
- Adobe Commerce and Magento Open Source 2.4.9
- Adobe Commerce and Magento Open Source 2.4.8-p5
- Adobe Commerce and Magento Open Source 2.4.7-p10
- Adobe Commerce and Magento Open Source 2.4.6-p15
- Adobe Commerce 2.4.5-p17
- Adobe Commerce 2.4.4-p18
Access to some patch downloads may require Composer credentials. Follow Adobe’s official instructions for applying isolated security patches.
Important: Adobe states that isolated security patches must be applied cumulatively and in release order. You must be on the latest security-only patch release for your supported release line and have the required earlier monthly isolated patches installed. Check Adobe’s instructions before applying a patch to avoid conflicts.
For Adobe Commerce on Cloud infrastructure, Adobe also provides the cloud-patches route for these security fixes. Check the latest cloud-patches update before applying an isolated patch, as applying a patch whose fix is already present can cause installation failures.
3. Verify the Applied Patches
Adobe recommends using the Commerce Version Tool (CVT) to check installed monthly security patches, identify missing patches, and review vulnerability status.
From the Adobe Commerce project root, check whether the tool is installed:
php vendor/bin/patch-status --version
If available, run:
php vendor/bin/patch-status
Review the output for applied patches, missing patches, and vulnerability status. Adobe notes that CVT is available through the July 2026 security isolated patch file; installations that do not have the tool may need that patch to obtain it.
Follow the official verification instructions for further details.
4. Apply the CVE-2026-75650 Hotfix and Rotate Credentials
Applying the October APSB26-153 security fixes does not replace the separate hotfix required for CVE-2026-75650.
Adobe’s guidance also recommends rotating encryption keys and associated credentials. This includes credentials that may have been encrypted or exposed using the affected key, such as integration tokens, payment gateway credentials, and system-privileged automation credentials.
Follow Adobe’s CVE-2026-75650 hotfix and credential rotation instructions.
Get Expert Magento Upgrade Support
Applying Adobe Commerce security fixes requires selecting the correct patch for your installed release line and following Adobe’s patching instructions. Isolated patches also have version and cumulative application requirements.
Meetanshi offers a dedicated Magento Upgrade Service for merchants who need help with Magento upgrades and related technical work.
Conclusion
Adobe’s APSB26-153 security update, released on October 13, 2026, addresses 11 vulnerabilities across critical, high, and medium severity levels. The reported impacts include arbitrary code execution, privilege escalation, arbitrary file system writes, and security feature bypasses.
Check your current Adobe Commerce, Magento Open Source, and Adobe Commerce B2B versions against Adobe’s affected-version list. Apply the appropriate October security fixes, verify the installed patches, and apply the separate CVE-2026-75650 hotfix with the recommended credential rotation steps.
Refer to Adobe’s official APSB26-153 security bulletin and its October patching instructions for the latest guidance.
Keep your store secure with the latest Magento 2 patches—add them before it’s too late.
Add Now
