Security update available for Adobe Commerce | APSB26-05
Bulletin ID
Date published
Priority
APSB26-05
March 10, 2026
2
style
grid width 12
Summary
Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves critical, important, and moderate vulnerabilities. Successful exploitation could lead to security feature bypass, application denial-of-service, privilege escalation, arbitrary code execution, and arbitrary file system read.
Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.
Affected versions
Product
Version
Priority rating
Platform
Adobe Commerce
2.4.9-alpha3 and earlier 2.4.8-p3 and earlier 2.4.7-p8 and earlier 2.4.6-p13 and earlier 2.4.5-p15 and earlier 2.4.4-p16 and earlier
2
All
Adobe Commerce B2B
1.5.3-alpha3 and earlier 1.5.2-p3 and earlier 1.4.2-p8 and earlier 1.3.5-p13 and earlier 1.3.4-p15 and earlier 1.3.3-p16 and earlier
2
All
Magento Open Source
2.4.9-alpha3 2.4.8-p3 and earlier 2.4.7-p8 and earlier 2.4.6-p13 and earlier 2.4.5-p15 and earlier
2
All
style
grid width 12
Solution
Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version.
Product
Updated Version
Platform
Priority rating
Installation Instructions
Adobe Commerce
2.4.9-beta1 for 2.4.9-alpha3 / 2.4.8-p4 for 2.4.8-p3 and earlier / 2.4.7-p9 for 2.4.7-p8 and earlier / 2.4.6-p14 for 2.4.6-p13 and earlier / 2.4.5-p16 for 2.4.5-p15 and earlier / 2.4.4-p17 for 2.4.4-p16 and earlier
1.5.3-beta1 for 1.5.3-alpha3 / 1.5.2-p4 for 1.5.2-p3 and earlier / 1.4.2-p9 for 1.4.2-p8 and earlier / 1.3.5-p14 for 1.3.5-p13 and earlier / 1.3.4-p16 for 1.3.4-p15 and earlier / 1.3.3-p17 for 1.3.3-p16 and earlier
All
2
Magento Open Source
2.4.9-beta1 for 2.4.9-alpha3 / 2.4.8-p4 for 2.4.8-p3 and earlier / 2.4.7-p9 for 2.4.7-p8 and earlier / 2.4.6-p14 for 2.4.6-p13 and earlier / 2.4.5-p16 for 2.4.5-p15 and earlier
URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
Security feature bypass
Moderate
Yes
No
3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
CVE-2026-21295
Note
Note: Authentication required to exploit means the vulnerability is exploitable only with credentials. Exploit requires admin privileges means the vulnerability is only exploitable by an attacker with administrative privileges.
style
xl spacing, one up, grid width 8, static-links, xxl-spacing-top
Acknowledgements
Adobe would like to thank the following researchers for reporting these issues and working with Adobe to help protect our customers:
You can control how Adobe websites use cookies and similar technologies by making choices below. But note that if you disable cookies and similar technologies entirely, Adobe websites may not function properly.
Cookies are small text files stored by your web browser when you use websites. There are also other technologies that can be used for similar purposes like HTML5 Local Storage and local shared objects, web beacons, and embedded scripts. These technologies help us do things like remembering you and your preferences when you return to our sites, measure how you use the website, conduct market research, and gather information about the ads you see and interact with.
You can make choices in the menu below about what cookies and other technologies you want us to use on Adobe sites when you visit them from this browser. You can always change those choices later by clicking on the Cookie Preferences link at the bottom of the page.
If enabled:
We can improve your experience by tailoring the site and the content to things we think might be of interest
We can better keep track of your preferences — like what language you prefer to use
We will better understand your likely interests so we can provide you more relevant Adobe ads and content on non-Adobe websites and in non-Adobe apps
It will help us improve the performance of our website and those of our partners who use the Adobe Experience Cloud
If disabled:
We won’t be able to remember you from session to session so the experience may not be tailored to your interests
You’ll still have access to the content of the site but certain features that depend on cookies may not function
You’ll still see ads, they just may not be as relevant to you
General information
You can control how Adobe websites use cookies and similar technologies by making choices below. But note that if you disable cookies and similar technologies entirely, Adobe websites may not function properly.
Cookies are small text files stored by your web browser when you use websites. There are also other technologies that can be used for similar purposes like HTML5 Local Storage, web beacons, and embedded scripts. These technologies help us do things like remembering you and your preferences when you return to our sites, measure how you use the website, conduct market research, and gather information about the ads you see and interact with.
You can make choices in the menu below about what cookies and other technologies you want us to use on Adobe sites when you visit them from this browser. You can always change those choices later by clicking on the Cookie Preferences link at the bottom of the page.
If enabled:
We can improve your experience by tailoring the site and the content to things we think might be of interest
We can better keep track of your preferences — like what language you prefer to use
We will better understand your likely interests so we can provide you more relevant Adobe ads and content on non-Adobe websites and in non-Adobe apps
It will help us improve the performance of our website and those of our partners who use the Adobe Experience Cloud
If disabled:
We won’t be able to remember you from session to session so the experience may not be tailored to your interests
We’ll still count your use of our site and services
You’ll still have access to the content of the site but certain features that depend on cookies may not function
You’ll still see ads, they just may not be as relevant to you
Operate the site and core servicesOperate site and measure engagement
Always active
These cookies are required, and they are used to enable the site and related services core functionality. Without them the site could not operate, so they cannot be disabled.
These cookies enable the site and related services’ core functionality and collect statistics about user engagement, such as counting active use to help us understand trends. These cookies cannot be disabled.
Measure performance
These cookies are used to analyze site usage to measure and improve performance. Without them Adobe cannot know what content is most valued and how often unique visitors return to the site, making it hard to improve information we offer to you.
These cookies are used to analyze site usage to measure and improve performance. Without them Adobe cannot know what content is most valued, making it hard to improve information we offer to you.
Extend functionality
These cookies are used to enhance the functionality of Adobe sites such as remembering your settings and preferences to deliver a personalized experience; for example, your username, your repeated visits, preferred language, your country, or any other saved preference.
Personalize advertising
These cookies are used to enable Adobe and our partners to serve ads more relevant to your interests. Without them you will still see ads, but they might not be as relevant to you.
