APSB26-153: Security update available for Adobe Commerce
Published Oct 13, 2026.
APSB26-153 (published 2026-10-13) discloses 11 CVEs in Adobe Commerce and Magento Open Source 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 and earlier; no fixing release yet; isolated patch 2026-oct.
Eleven vulnerabilities, five of them exploitable without authentication, led by a template engine injection (CVE-2026-103849, CVSS 10.0) that lets an unauthenticated attacker execute arbitrary code. Also fixes an incorrect authorization flaw in B2B allowing unauthenticated code execution (CVE-2026-92909, CVSS 9.8), stored cross-site scripting, and an admin input validation flaw allowing arbitrary file system writes. Adobe reports no exploitation in the wild. Adobe ships the fix as the 2026-oct isolated patch level on top of the base release, not as a new -pN release; Adobe asks merchants to apply the APSB26-146 hotfix in addition.
- Published
- Oct 13, 2026
- Severity
- critical
- CVEs
- 11
- Isolated patch
- yes
CVEs
| CVE | CVSS | Type | Impact | Auth required |
|---|---|---|---|---|
| CVE-2026-103849 | 10 | improper-neutralization-of-special-elements-used-in-a-template-engine | arbitrary-code-execution | no |
| CVE-2026-92909 | 9.8 | improper-authorization | arbitrary-code-execution | no |
| CVE-2026-91013 | 9.3 | cross-site-scripting-stored | privilege-escalation | no |
| CVE-2026-100133 | 9.3 | cross-site-scripting-stored | privilege-escalation | no |
| CVE-2026-92464 | 9.1 | improper-input-validation | arbitrary-code-execution | yes |
| CVE-2026-92911 | 8.7 | cross-site-scripting-stored | arbitrary-code-execution | yes |
| CVE-2026-95631 | 8.7 | improper-input-validation | arbitrary-file-system-write | yes |
| CVE-2026-92908 | 8.3 | improper-authorization | security-feature-bypass | yes |
| CVE-2026-92922 | 8.1 | cross-site-scripting-stored | privilege-escalation | yes |
| CVE-2026-92910 | 7.2 | improper-authorization | security-feature-bypass | no |
| CVE-2026-95630 | 4.3 | improper-input-validation | security-feature-bypass | yes |
Fixed in
Isolated patch only: no release fixes this. Apply the patch on the base versions listed below.
Isolated patches
- 2026-oct — applies to 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18
References
- https://www.adobe.com/trust/security/products/commerce/apsb26-153.html
- https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-49323
For integrators
Get this bulletin as JSON:
curl -s https://magento.watch/api/v1/security-bulletins/APSB26-153
