SECURITY BULLETINS
Magento and Adobe Commerce security bulletins
Every tracked Adobe security bulletin with its CVEs and the exact patch version that fixes each one.
This is machine-readable Adobe/Magento CVE data mapped to the fixed-in patch version, kept in sync with the version-lifecycle data on this site — built for CI pipelines, monitoring and coding agents, not just for reading in a browser.
curl -s https://magento.watch/api/v1/magento-community/versions/2.4.7/security
MCP clients get the same answer from the check_version_security tool.
| Bulletin | Published | Severity | CVEs | Magento Open Source | Adobe Commerce | Mage-OS |
|---|---|---|---|---|---|---|
| APSB26-153 | 2026-10-13 | critical | CVE-2026-103849, CVE-2026-92909, CVE-2026-91013, CVE-2026-100133, CVE-2026-92464, CVE-2026-92911, CVE-2026-95631, CVE-2026-92908, CVE-2026-92922, CVE-2026-92910, CVE-2026-95630 | Open Source— | Commerce— | Mage-OS— |
| Eleven vulnerabilities, five of them exploitable without authentication, led by a template engine injection (CVE-2026-103849, CVSS 10.0) that lets an unauthenticated attacker execute arbitrary code. Also fixes an incorrect authorization flaw in B2B allowing unauthenticated code execution (CVE-2026-92909, CVSS 9.8), stored cross-site scripting, and an admin input validation flaw allowing arbitrary file system writes. Adobe reports no exploitation in the wild. Adobe ships the fix as the 2026-oct isolated patch level on top of the base release, not as a new -pN release; Adobe asks merchants to apply the APSB26-146 hotfix in addition. Adobe revised the patch release notes on 2026-10-15 and reissued the 2.4.8-p5 Community Edition patch file on 2026-10-14; the email template validation fixes ship inside that Community Edition file, not as a separate patch. | ||||||
| APSB26-138 | 2026-09-08 | critical | CVE-2026-76200, CVE-2026-76201, CVE-2026-77111, CVE-2026-77109, CVE-2026-77774, CVE-2026-76202, CVE-2026-77110, CVE-2026-77108 | Open Source— | Commerce— | Mage-OS— |
| Eight vulnerabilities, six of them exploitable without authentication, including two stored cross-site scripting flaws (CVE-2026-76200, CVE-2026-76201, CVSS 9.3) and several incorrect authorization flaws. Successful exploitation could result in security feature bypass and privilege escalation. Adobe ships the fix as the 2026-sep isolated patch level on top of the base release, not as a new -pN release; Adobe asks merchants to apply the APSB26-146 hotfix in addition. | ||||||
| APSB26-146 | 2026-09-07 | critical | CVE-2026-75650 | Open Source— | Commerce— | Mage-OS— |
| Template engine injection (CVE-2026-75650, CVSS 10.0) that lets an unauthenticated attacker execute arbitrary code. Adobe reports exploitation in the wild. Fixed by the hotfix for CVE-2026-75650 (VULN-39341), which Adobe's APSB26-138 bulletin asks merchants to apply in addition to the September 2026 security update; Adobe also tells merchants to rotate their encryption keys. | ||||||
| APSB26-92 | 2026-08-11 | critical | CVE-2026-71362, CVE-2026-48414, CVE-2026-48413, CVE-2026-48415, CVE-2026-48416, CVE-2026-48411, CVE-2026-48412 | Open Source— | Commerce— | Mage-OS— |
| Seven vulnerabilities, led by an unauthenticated incorrect authorization flaw (CVE-2026-71362, CVSS 9.1) and two stored cross-site scripting flaws. Successful exploitation could result in security feature bypass, arbitrary code execution and privilege escalation. Adobe ships the fix as the 2026-aug isolated patch level on top of the base release, not as a new -pN release. | ||||||
| APSB26-73 | 2026-07-14 | critical | CVE-2026-48356, CVE-2026-48358, CVE-2026-47994, CVE-2026-47988, CVE-2026-47984, CVE-2026-47995, CVE-2026-47996, CVE-2026-47992, CVE-2026-47997, CVE-2026-47998, CVE-2026-48371, CVE-2026-47999, CVE-2026-48000, CVE-2026-48001 | Open Source— | Commerce— | Mage-OS— |
| Fourteen vulnerabilities, led by an unauthenticated unrestricted file upload (CVE-2026-48356, CVSS 9.6) and several incorrect authorization and stored cross-site scripting flaws. Successful exploitation could lead to arbitrary code execution, privilege escalation and security feature bypass. Adobe ships the fix as the 2026-jul isolated patch level on top of the base release, not as a new -pN release. | ||||||
| APSB26-49 | 2026-05-12 | critical | CVE-2026-34645, CVE-2026-34646, CVE-2026-34647, CVE-2026-34648, CVE-2026-34649, CVE-2026-34650, CVE-2026-34651, CVE-2026-34652, CVE-2026-34686, CVE-2026-34653, CVE-2026-34654, CVE-2026-34655, CVE-2026-34656, CVE-2026-34658, CVE-2026-34685 | Open Source2.4.9 | Commerce2.4.9 | Mage-OS— |
| Fifteen vulnerabilities, including incorrect authorization, server-side request forgery, uncontrolled resource consumption, vulnerable third-party components and stored cross-site scripting; one path traversal allows arbitrary file system write. Successful exploitation could lead to arbitrary code execution, arbitrary file system write, application denial-of-service and security feature bypass. Fixed in the May 2026 patch releases, including the 2.4.9 GA release. | ||||||
| APSB26-05 | 2026-03-10 | critical | CVE-2026-21361, CVE-2026-21284, CVE-2026-21289, CVE-2026-21290, CVE-2026-21311, CVE-2026-21309, CVE-2026-21285, CVE-2026-21286, CVE-2026-21291, CVE-2026-21292, CVE-2026-21293, CVE-2026-21294, CVE-2026-21359, CVE-2026-21360, CVE-2026-21282, CVE-2026-21310, CVE-2026-21296, CVE-2026-21297, CVE-2026-21295 | Open Source2.4.8-p4 | Commerce2.4.8-p4 | Mage-OS— |
| Nineteen vulnerabilities, mainly stored cross-site scripting and incorrect authorization, plus server-side request forgery, path traversal, improper input validation and an open redirect. Successful exploitation could lead to security feature bypass, privilege escalation, arbitrary code execution, arbitrary file system read and application denial-of-service. Fixed in the March 2026 patch releases. | ||||||
| APSB25-94 | 2025-10-14 | critical | CVE-2025-54263, CVE-2025-54264, CVE-2025-54265, CVE-2025-54266, CVE-2025-54267 | Open Source2.4.8-p3 | Commerce2.4.8-p3 | Mage-OS— |
| Incorrect authorization (CVE-2025-54263, CVE-2025-54265, CVE-2025-54267) and stored cross-site scripting in the admin (CVE-2025-54264, CVE-2025-54266) that allow security feature bypass, privilege escalation and arbitrary code execution. Four of the five issues require authentication. Fixed in the October 2025 patch releases. | ||||||
| APSB25-88 | 2025-09-09 | critical | CVE-2025-54236 | Open Source2.4.8-p2 | Commerce2.4.8-p2 | Mage-OS— |
| Improper input validation in the Web API's service input processor (CVE-2025-54236), publicly known as SessionReaper. An unauthenticated attacker can hijack customer sessions through the REST API and, depending on configuration, reach remote code execution. Adobe shipped the out-of-band hotfix VULN-32437 before the regular patch release; it was the first emergency patch since CosmicSting. | ||||||
| APSB25-71 | 2025-08-12 | critical | CVE-2025-49557 | Open Source2.4.8-p2 | Commerce2.4.8-p2 | Mage-OS— |
| Improper access control (CVE-2025-49557) and related flaws that let an attacker bypass security features and reach functionality that should require authorization. Shipped with the regular August 2025 patch set for the 2.4.4 to 2.4.8 lines. | ||||||
| APSB25-50 | 2025-06-10 | critical | CVE-2025-47110 | Open Source2.4.8-p1 | Commerce2.4.8-p1 | Mage-OS— |
| Stored cross-site scripting in the admin panel (CVE-2025-47110) that can be chained into arbitrary code execution when an administrator views the injected content. Fixed in the June 2025 patch set, including 2.4.8-p1. | ||||||
| APSB25-26 | 2025-04-08 | critical | CVE-2025-27189 | Open Source2.4.8 | Commerce2.4.8 | Mage-OS— |
| Improper authorization (CVE-2025-27189) allowing a security feature bypass, published alongside the 2.4.8 general availability release. Older lines receive the fix through their April 2025 patch versions. | ||||||
| APSB25-08 | 2025-02-11 | critical | CVE-2025-24434 | Open Source2.4.7-p4 | Commerce2.4.7-p4 | Mage-OS— |
| Improper authorization (CVE-2025-24434) that lets a low-privileged actor escalate privileges; Adobe rated it critical because exploitation does not require user interaction. Fixed in the February 2025 patch set. | ||||||
| APSB24-73 | 2024-10-08 | critical | CVE-2024-45115 | Open Source2.4.7-p3 | Commerce2.4.7-p3 | Mage-OS— |
| Improper authentication (CVE-2024-45115) that allows privilege escalation without prior authentication. Part of the October 2024 patch set that followed the CosmicSting exploitation wave. | ||||||
| APSB24-61 | 2024-08-13 | critical | CVE-2024-39397 | Open Source2.4.7-p2 | Commerce2.4.7-p2 | Mage-OS— |
| Unrestricted upload of a file with a dangerous type (CVE-2024-39397) allowing arbitrary code execution by an unauthenticated attacker; Adobe notes the exploit requires the Apache web server. Fixed in the August 2024 patch set. | ||||||
| APSB24-40 | 2024-06-11 | critical | CVE-2024-34102 | Open Source2.4.7-p1 | Commerce2.4.7-p1 | Mage-OS— |
| XML external entity injection in the REST API (CVE-2024-34102), publicly known as CosmicSting. An unauthenticated attacker can read arbitrary files such as env.php and, chained with the glibc iconv bug CVE-2024-2961, execute code. Mass exploitation followed within weeks; Adobe also released an isolated patch for stores that could not upgrade. | ||||||
| APSB24-18 | 2024-04-09 | critical | CVE-2024-20758, CVE-2024-20759 | Open Source2.4.7 | Commerce2.4.7 | Mage-OS— |
| Improper input validation (CVE-2024-20758) enabling arbitrary code execution by an authenticated administrator, plus stored cross-site scripting (CVE-2024-20759). Published with the 2.4.7 general availability release and the April 2024 patch set. | ||||||
See also: all versions · JSON API · MCP server
