Adobe Releases Critical Security Updates for Adobe Commerce and Magento Open Source – APSB26-153
Adobe has released a new security update, APSB26-153, addressing multiple vulnerabilities affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source.
The update includes several critical vulnerabilities that could potentially allow attackers to execute malicious code, gain elevated privileges, modify server files, or bypass security protections.
At Zynovo, we strongly encourage all merchants running affected versions to review this advisory and prioritize applying the appropriate security updates.
What You Need to Know
The October 13, 2026 security bulletin addresses 11 vulnerabilities, including five classified as Critical.
One of the most serious issues, CVE-2026-103849, carries a maximum CVSS severity score of 10.0 and could allow unauthenticated attackers to execute arbitrary code.
Another critical vulnerability, CVE-2026-92909, affects Adobe Commerce B2B and carries a CVSS score of 9.8.
Other vulnerabilities involve privilege escalation, improper authorization, stored cross-site scripting (XSS), and security feature bypass.
Importantly, Adobe reports that it is not aware of active exploitation of these vulnerabilities in the wild as of the bulletin’s publication. However, their severity makes timely remediation essential.
Which Versions Are Affected?
The advisory covers supported release lines of:
- Adobe Commerce: 2.4.4 through 2.4.9, including September 2026 security releases and earlier versions.
- Magento Open Source: 2.4.6 through 2.4.9, including September 2026 security releases and earlier versions.
- Adobe Commerce B2B: Multiple versions, including the 1.3.x, 1.4.x, and 1.5.x release lines.
Merchants should verify their exact installed version against Adobe’s official bulletin to determine the appropriate update.
Recommended Actions for Merchants
Zynovo recommends taking the following precautions:
- Review your current version and identify whether your Adobe Commerce or Magento installation is affected.
- Apply the October 2026 security updates using Adobe’s version-specific isolated patches or applicable Cloud Patches.
- Verify the September security hotfix, CVE-2026-75650, has also been applied. Adobe specifically recommends this additional protection.
- Review encryption keys and credentials and follow Adobe’s recommendation to rotate them as part of remediation.
- Test and validate the changes, including checkout, payment integrations, extensions, and other business-critical functions, before and after production deployment.
Adobe has made isolated patches available to help merchants address these security issues without waiting for a full platform upgrade.
How Zynovo Can Help
Keeping an eCommerce platform secure requires more than installing patches. Updates must be carefully evaluated to minimize compatibility issues and disruption to business operations.
At Zynovo, we help Adobe Commerce and Magento Open Source merchants with security assessments, patch implementation, extension compatibility testing, and ongoing platform maintenance.
If your website is running an affected version, we recommend scheduling a security review and applying the necessary updates as soon as possible.
Protect your online store before vulnerabilities become business risks.
Contact Zynovo to discuss your Magento security and maintenance needs.
Official Adobe Security Advisory:
https://www.adobe.com/trust/security/products/commerce/apsb26-153.html