Adobe Security Bulletin

Last updated on Sep 8, 2026

Security update available for Adobe Commerce | APSB26-138

Bulletin ID

Date published

Priority

APSB26-138

September 8, 2026

2

style

grid width 12

Summary

Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves critical, important, and moderate vulnerabilities. Successful exploitation could result in security feature bypass and privilege escalation.

Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.

Affected Versions

Product

Version

Platform

Adobe Commerce

2.4.9-2026-aug and earlier
2.4.8-2026-aug and earlier
2.4.7-2026-aug and earlier
2.4.6-2026-aug and earlier
2.4.5-2026-aug and earlier
2.4.4-2026-aug and earlier

All

Adobe Commerce B2B

1.5.3-2026-aug and earlier
1.5.2-2026-aug and earlier
1.4.2-2026-aug and earlier
1.3.4-2026-aug and earlier
1.3.3-2026-aug and earlier

All

Magento Open Source

2.4.9-2026-aug and earlier
2.4.8-2026-aug and earlier
2.4.7-2026-aug and earlier
2.4.6-2026-aug and earlier

All

style

grid width 12

Solution

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version.

Product

Updated version

Platform

Priority rating

Installation instructions

Adobe Commerce

2.4.9-2026-sep
2.4.8-2026-sep
2.4.7-2026-sep
2.4.6-2026-sep
2.4.5-2026-sep
2.4.4-2026-sep

All

2

Release Notes for September 2026 security update APSB26-138

Adobe Commerce B2B

1.5.3-2026-sep
1.5.2-2026-sep
1.4.2-2026-sep
1.3.4-2026-sep
1.3.3-2026-sep

All

2

Release Notes for September 2026 security update APSB26-138

Magento Open Source

2.4.9-2026-sep
2.4.8-2026-sep
2.4.7-2026-sep

All

2

Release Notes for September 2026 security update APSB26-138

style

grid width 12

Note

On September 7, 2026, Adobe released a critical security update (APSB26-146) affecting Adobe Commerce and Magento Open Source. Please apply the Hotfix for CVE-2026-75650 in addition to the security updates released in this bulletin.

style

xl spacing, one up, grid width 12, static-links, xxl-spacing-top

Vulnerability Details

CVE-2026-76200

Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Critical
Authentication required to exploit? No
CVSS base score: 9.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Notes:

CVE-2026-76201

Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Privilege Escalation
Severity: Critical
Authentication required to exploit? No
CVSS base score: 9.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Notes:

CVE-2026-77111

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Security feature bypass
Severity: Critical
Authentication required to exploit? Yes
CVSS base score: 8.7
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
Notes:

CVE-2026-77109

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Privilege escalation
Severity: Critical
Authentication required to exploit? No
CVSS base score: 8.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Notes: B2B

CVE-2026-77774

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Security feature bypass
Severity: Critical
Authentication required to exploit? No
CVSS base score: 8.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Notes:

CVE-2026-76202

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Privilege escalation
Severity: Critical
Authentication required to exploit? No
CVSS base score: 8.2
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Notes:

CVE-2026-77110

Vulnerability category: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Vulnerability impact: Security feature bypass
Severity: Critical
Authentication required to exploit? Yes
CVSS base score: 7.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L
Notes:

CVE-2026-77108

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Privilege escalation
Severity: Critical
Authentication required to exploit? No
CVSS base score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Notes: B2B

Note

Effective August 11, 2026, Adobe may assign a single CVE identifier to internally discovered vulnerabilities with the same severity rating and CWE category when a release includes systemic fixes.

Note

Authentication required to exploit: The vulnerability is (or is not) exploitable without credentials.

style

xl spacing, one up, grid width 12, static-links, xxl-spacing-top

Acknowledgements

Adobe would like to thank the following researchers for reporting these issues and working with Adobe to help protect our customers:

0x0.eth (0x0doteth) — CVE-2026-76200, CVE-2026-76201, CVE-2026-77109
wohlie — CVE-2026-77108
e0x1337 (e0x1337) — CVE-2026-76202

NOTE: Adobe has a public bug bounty program with Intigriti. If you are interested in working with Adobe as an external security researcher, please check out https://app.intigriti.com/programs/adobe/adobepublic/detail.

For more information, visit https://www.adobe.com/trust/security/bug-bounty.html, or email PSIRT@adobe.com.

CardTitle

APSB26-138

CardDescription

Priority 2 Security update

CardImage

Created

2026-09-08