On October 13, 2026, Adobe released a regularly scheduled security update for Adobe Commerce and Magento Open Source, published as bulletin APSB26-153. This Magento security update resolves critical, high, and medium-severity vulnerabilities that, if successfully exploited, could lead to arbitrary code execution, privilege escalation, arbitrary file system write, and security feature bypass. We recommend that every merchant running Adobe Commerce, Adobe Commerce B2B, or Magento Open Source plan to apply it promptly.
Adobe Security Bulletin – APSB26-153
Adobe has assigned this update a Priority 2 rating across Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. Adobe states it is not aware of any exploits in the wild for these issues. Full details are available in Adobe’s official bulletin: Security update available for Adobe Commerce | APSB26-153.
Key Details of the Magento Security Update
APSB26-153 addresses 11 CVEs: five rated Critical, five High, and one Medium. Several can be triggered without authentication, which is what makes this release worth prioritizing.
| CVE | Severity | CVSS | Auth Req. | Weakness → Impact |
|---|---|---|---|---|
| CVE-2026-103849 | Critical | 10.0 | No | Template engine injection → code execution |
| CVE-2026-92909 | Critical | 9.8 | No | Incorrect authorization → code execution (B2B) |
| CVE-2026-91013 | Critical | 9.3 | No | Stored XSS → privilege escalation |
| CVE-2026-100133 | Critical | 9.3 | No | Stored XSS → privilege escalation |
| CVE-2026-92464 | Critical | 9.1 | Yes | Improper input validation → code execution |
| CVE-2026-92911 | High | 8.7 | Yes | Stored XSS → code execution |
| CVE-2026-95631 | High | 8.7 | Yes | Improper input validation → file system write |
| CVE-2026-92908 | High | 8.3 | Yes | Incorrect authorization → feature bypass (B2B) |
| CVE-2026-92922 | High | 8.1 | Yes | Stored XSS → privilege escalation |
| CVE-2026-92910 | High | 7.2 | No | Incorrect authorization → feature bypass (B2B) |
| CVE-2026-95630 | Medium | 4.3 | Yes | Improper input validation → feature bypass |
The headline vulnerability: CVE-2026-103849 (CVSS 10.0)
The most serious issue is a template engine injection flaw scored at the maximum CVSS 10.0. It requires no authentication and no user interaction, and could allow an attacker to execute code on an unpatched store. Two stored cross-site scripting issues (CVE-2026-91013 and CVE-2026-100133) are also rated Critical and do not require authentication, though they rely on user interaction.
B2B merchants: three additional fixes
Merchants running Adobe Commerce B2B should note three incorrect-authorization vulnerabilities specific to the B2B module, including CVE-2026-92909 (CVSS 9.8), which could lead to code execution without authentication.
Affected and Fixed Versions
| Product | Affected (2026-sep and earlier) | Fixed release |
|---|---|---|
| Adobe Commerce | 2.4.4 – 2.4.9 | 2.4.4 – 2.4.9 (2026-oct builds), 2.4.10-alpha1 |
| Adobe Commerce B2B | 1.3.3, 1.3.4, 1.4.2, 1.5.2, 1.5.3 | Same lines (2026-oct builds), 1.5.4-alpha1 |
| Magento Open Source | 2.4.6 – 2.4.9 | 2.4.7 – 2.4.9 (2026-oct builds), 2.4.10-alpha1 |
Note: Magento Open Source 2.4.6 is listed as affected, but the bulletin does not list a fixed 2.4.6 release. If you are still on 2.4.6, this is the right time to plan an upgrade to a supported release line. Installation instructions are in Adobe’s APSB26-153 release notes.
Don’t Miss the APSB26-146 Hotfix
Adobe’s bulletin also reminds merchants that critical bulletin APSB26-146 was released on September 7, 2026. If you have not yet applied the hotfix for CVE-2026-75650, apply it alongside this update. Details are in Adobe’s APSB26-146 knowledge base article.
Who Should Apply These Updates?
Adobe recommends that all merchants apply the latest security updates as soon as possible, and warns that it will have limited means to help with remediation on stores that remain unpatched.
- Adobe Commerce on Managed Services: your Customer Success Engineer can provide guidance on applying the patch.
- Adobe Commerce on cloud and on-premises: coordinate with your development and security teams, or a qualified partner, to test and deploy the update.
- Magento Open Source: apply the 2026-oct release for your version line, and confirm your version still receives security fixes.
Adobe Commerce Patching Automation
Adobe has introduced Adobe Commerce Patching Automation, a standalone service within the Adobe Commerce Site-Wide Analysis Tool. It lets teams view the patches available for a selected project and environment from the Commerce Admin and streamlines applying the monthly security patch. Automation speeds things up, but it does not replace regression testing of your extensions, customizations, and integrations before production.
Staying Up-to-Date on Adobe Commerce Security
Adobe publishes security updates on a regular monthly cadence. Bookmark Adobe’s Adobe Commerce security bulletins page so you know when a new Magento security update is available. If you missed last month’s release, see our post on APSB26-92.
Adobe Commerce Support from Crimson Agility
Crimson Agility provides Adobe Commerce support and managed services for Adobe Commerce and Magento Open Source merchants, including:
- Installing and testing security patches such as APSB26-153
- Checking your store for signs of compromise
- Monitoring for new Adobe Commerce releases and security bulletins
- Health and security audits, and upgrade planning for end-of-support versions
Final Thoughts
Security is an ongoing process, not a one-time task. With a CVSS 10.0 vulnerability that requires no authentication, this security update for Adobe Commerce should be scheduled now rather than at your next maintenance window. If you need help applying APSB26-153 or want a review of your store’s security posture, contact our team or call (480) 506-0482.
Best regards,
The Crimson Agility Team
