Critical Security Update for Magento/Adobe Commerce (APSB26-92)

On August 11, 2026, Adobe released a new security bulletin, APSB26-92, resolving multiple vulnerabilities across Adobe Commerce and Magento Open Source.

The update carries a Priority 2 rating. That means Adobe is not aware of any active exploits in the wild yet, but the vulnerabilities are serious enough that you should update without delay. Left unpatched, they could allow security feature bypass, arbitrary code execution, and privilege escalation.

Applying these patches promptly is the simplest way to keep your store, your customer data, and your reputation safe.

Who Is at Risk? (Affected Versions)

If your store runs any of the versions below at the July 2026 patch level or earlier, it is currently vulnerable. Check your Magento version before you decide.

Critical Vulnerabilities Explained

APSB26-92 fixes seven vulnerabilities, five of them rated Critical. The most serious can be exploited over the network with no login at all.

The one that deserves your immediate attention is CVE-2026-71362, which scores 9.1. It requires no authentication and no admin privileges, so an attacker could escalate privileges remotely without ever logging in. That combination is what makes it so dangerous.

Two stored XSS flaws, CVE-2026-48413 and CVE-2026-48414, can lead to arbitrary code execution, and the remaining authorization flaws can bypass security controls. For B2B stores, CVE-2026-48416 is also exploitable without authentication.

Left unpatched, these holes put your admin panel, your customer payment data, and your uptime at real risk.

The Fix: New Patch Versions Released

Adobe has released patched versions dated August 2026. Adobe’s official guidance is to upgrade to the matching version for your product immediately.

Action Plan: How to Secure Your Store

Do not wait for a breach. Follow these steps to protect your Magento instance. Use the Adobe Security Scan Tool to identify current gaps. Apply patches in a staging environment first, so you can confirm your theme and extensions stay compatible.

• Once verified, push the update to production and monitor your logs for anything unusual.

Technical Upgrade (via CLI)

If you have a technical team, they can run the upgrade from the command line in your store’s root directory. Replace [VERSION] with your target version from Adobe’s August 2026 release notes, for example 2.4.8-2026-aug.

For Magento Open Source:

composer require magento/product-community-edition=[VERSION] --no-update
composer update

For Adobe Commerce:

composer require magento/product-enterprise-edition=[VERSION] --no-update
composer update

Then run the standard post-upgrade steps:

php bin/magento setup:upgrade
php bin/magento setup:di:compile
php bin/magento setup:static-content:deploy -f
php bin/magento cache:flush

Important: always take a full backup and test the upgrade in staging before you apply it to your live store.

A Safer Alternative: Professional Upgrade Service

Upgrading is more than running a few commands. It means verifying extension compatibility, checking custom code, and making sure your themes and integrations keep working perfectly after the patch.

Our Magento Upgrade Service manages the entire process, from staging audits to final deployment, with zero data loss and no downtime for your customers.

Why teams choose us:

• We check every third-party module and custom integration.
• We keep your store fast and SEO-friendly after the upgrade.
• We review your server environment for protection that goes beyond the patch itself.

Move to the latest secure version with our Adobe-certified experts.

Move to Magento 2.4.8

Enjoy a hassle free upgrade to the latest Magento version with our Adobe-certified experts.

Upgrade Now