Adobe Security Bulletin

Last updated on Sep 8, 2026

Security update available for Adobe Commerce | APSB26-138

Bulletin ID

Date published

Priority

APSB26-138

September 8, 2026

2

style

grid width 12

Summary

Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves critical, important, and moderate vulnerabilities. Successful exploitation could result in security feature bypass and privilege escalation.

Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.

Affected Versions

Product

Version

Platform

Adobe Commerce

2.4.9-2026-aug and earlier
2.4.8-2026-aug and earlier
2.4.7-2026-aug and earlier
2.4.6-2026-aug and earlier
2.4.5-2026-aug and earlier
2.4.4-2026-aug and earlier

All

Adobe Commerce B2B

1.5.3-2026-aug and earlier
1.5.2-2026-aug and earlier
1.4.2-2026-aug and earlier
1.3.4-2026-aug and earlier
1.3.3-2026-aug and earlier

All

Magento Open Source

2.4.9-2026-aug and earlier
2.4.8-2026-aug and earlier
2.4.7-2026-aug and earlier
2.4.6-2026-aug and earlier

All

style

grid width 12

Solution

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version.

Product

Updated version

Platform

Priority rating

Installation instructions

Adobe Commerce

2.4.9-2026-sep
2.4.8-2026-sep
2.4.7-2026-sep
2.4.6-2026-sep
2.4.5-2026-sep
2.4.4-2026-sep

All

2

Release Notes for September 2026 security update APSB26-138

Adobe Commerce B2B

1.5.3-2026-sep
1.5.2-2026-sep
1.4.2-2026-sep
1.3.4-2026-sep
1.3.3-2026-sep

All

2

Release Notes for September 2026 security update APSB26-138

Magento Open Source

2.4.9-2026-sep
2.4.8-2026-sep
2.4.7-2026-sep

All

2

Release Notes for September 2026 security update APSB26-138

style

grid width 12

Note

On September 7, 2026, Adobe released a critical security update (APSB26-146) affecting Adobe Commerce and Magento Open Source. Please apply the Hotfix for CVE-2026-75650 in addition to the security updates released in this bulletin.

style

xl spacing, one up, grid width 12, static-links, xxl-spacing-top

Vulnerability Details

Vulnerability category

Vulnerability impact

Severity

Authentication required to exploit?

CVSS base score

CVSS vector

CVE number(s)

Notes

Cross-site Scripting (Stored XSS) (CWE-79)

Privilege escalation

Critical

No

9.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CVE-2026-76200

Cross-site Scripting (Stored XSS) (CWE-79)

Privilege Escalation

Critical

No

9.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CVE-2026-76201

Incorrect Authorization (CWE-863)

Security feature bypass

Critical

Yes

8.7

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

CVE-2026-77111

Incorrect Authorization (CWE-863)

Privilege escalation

Critical

No

8.6

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

CVE-2026-77109

B2B

Incorrect Authorization (CWE-863)

Security feature bypass

Critical

No

8.6

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CVE-2026-77774

Incorrect Authorization (CWE-863)

Privilege escalation

Critical

No

8.2

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CVE-2026-76202

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Security feature bypass

Critical

Yes

7.6

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L

CVE-2026-77110

Incorrect Authorization (CWE-863)

Privilege escalation

Critical

No

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVE-2026-77108

B2B

Note

Effective August 11, 2026, Adobe may assign a single CVE identifier to internally discovered vulnerabilities with the same severity rating and CWE category when a release includes systemic fixes.

Note

Authentication required to exploit: The vulnerability is (or is not) exploitable without credentials.

style

xl spacing, one up, grid width 12, static-links, xxl-spacing-top

Acknowledgements

Adobe would like to thank the following researchers for reporting these issues and working with Adobe to help protect our customers:

0x0.eth (0x0doteth) — CVE-2026-76200, CVE-2026-76201, CVE-2026-77109
wohlie — CVE-2026-77108
e0x1337 (e0x1337) — CVE-2026-76202

NOTE: Adobe has a public bug bounty program with HackerOne. If you are interested in working with Adobe as an external security researcher, please check out https://app.intigriti.com/programs/adobe/adobepublic/detail.

For more information, visit https://www.adobe.com/trust/security/bug-bounty.html, or email PSIRT@adobe.com.

CardTitle

APSB26-138

CardDescription

Priority 2 Security update

CardImage

Created

2026-09-08