Adobe Security Bulletin

Last updated on Oct 13, 2026

Security update available for Adobe Commerce | APSB26-153

Bulletin ID

Date published

Priority

APSB26-153

October 13, 2026

2

style

grid width 12

Summary

Adobe has released a priority 2 security update for Adobe Commerce. This update addresses vulnerabilities rated critical, high, and medium that could result in arbitrary code execution, privilege escalation, arbitrary file system write, and security feature bypass.

Adobe is not aware of any exploits in the wild for any of the issues addressed in this update.

Affected Versions

Product

Version

Platform

Adobe Commerce

2.4.9-2026-sep and earlier

2.4.8-2026-sep and earlier

2.4.7-2026-sep and earlier

2.4.6-2026-sep and earlier

2.4.5-2026-sep and earlier

2.4.4-2026-sep and earlier

All

Adobe Commerce B2B

1.5.3-2026-sep and earlier

1.5.2-2026-sep and earlier

1.4.2-2026-sep and earlier

1.3.4-2026-sep and earlier

1.3.3-2026-sep and earlier

All

Magento Open Source

2.4.9-2026-sep and earlier

2.4.8-2026-sep and earlier

2.4.7-2026-sep and earlier

2.4.6-2026-sep and earlier

All

style

grid width 12

Solution

Adobe categorizes this update with the following priority rating and recommends users update their installation to the newest version:

Note

On September 7, 2026, Adobe released a critical security update (APSB26-146) affecting Adobe Commerce and Magento Open Source. Please apply the Hotfix for CVE-2026-75650 in addition to the security updates released in this bulletin.

Product

Updated version

Platform

Priority rating

Installation instructions

Adobe Commerce

2.4.10-alpha1

2.4.9-2026-oct

2.4.8-2026-oct

2.4.7-2026-oct

2.4.6-2026-oct

2.4.5-2026-oct

2.4.4-2026-oct

All

2

Release notes for security update APSB26-153

Adobe Commerce B2B

1.5.4-alpha1

1.5.3-2026-oct

1.5.2-2026-oct

1.4.2-2026-oct

1.3.4-2026-oct

1.3.3-2026-oct

All

2

Release notes for security update APSB26-153

Magento Open Source

2.4.10-alpha1

2.4.9-2026-oct

2.4.8-2026-oct

2.4.7-2026-oct

All

2

Release notes for security update APSB26-153

style

grid width 12

Note

2.4.10-alpha1 is the first alpha release for the 2.4.10 release line.

Vulnerability Details

CVE-2026-103849

Vulnerability category: Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
Vulnerability impact: Arbitrary code execution
Severity: Critical
Authentication required to exploit? No
CVSS base score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Notes:

CVE-2026-92909

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: Critical
Authentication required to exploit? No
CVSS base score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Notes: B2B

CVE-2026-91013

Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Critical
Authentication required to exploit? No
CVSS base score: 9.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Notes:

CVE-2026-100133

Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Critical
Authentication required to exploit? No
CVSS base score: 9.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Notes:

CVE-2026-92464

Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Arbitrary code execution
Severity: Critical
Authentication required to exploit? Yes
CVSS base score: 9.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Notes:

CVE-2026-92911

Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: High
Authentication required to exploit? Yes
CVSS base score: 8.7
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Notes:

CVE-2026-95631

Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Arbitrary file system write
Severity: High
Authentication required to exploit? Yes
CVSS base score: 8.7
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
Notes:

CVE-2026-92908

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Security feature bypass
Severity: High
Authentication required to exploit? Yes
CVSS base score: 8.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Notes: B2B

CVE-2026-92922

Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: High
Authentication required to exploit? Yes
CVSS base score: 8.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Notes:

CVE-2026-92910

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Security feature bypass
Severity: High
Authentication required to exploit? No
CVSS base score: 7.2
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Notes: B2B

CVE-2026-95630

Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Security feature bypass
Severity: Medium
Authentication required to exploit? Yes
CVSS base score: 4.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Notes:

Note

"Authentication required to exploit?" indicates whether an attacker must be authenticated to exploit the issue.

style

xl spacing, one up, grid width 12, static-links, xxl-spacing-top

Acknowledgments

Adobe would like to thank the following researchers for reporting the relevant issues and for working with Adobe to help protect our customers:

vozec — CVE-2026-103849
g4mb4 (g4mb4) — CVE-2026-92909, CVE-2026-92908
tracey (tracey01) — CVE-2026-91013
adobepatcher — CVE-2026-100133
Rafael (prnig) — CVE-2026-92464
wohlie — CVE-2026-92911
jk-brah — CVE-2026-92922
Buba Soumah — CVE-2026-92910
0x0.eth (0x0doteth) — CVE-2026-95630

NOTE: Adobe maintains a public bug bounty program through Intigriti. If you’re an external security researcher interested in identifying and responsibly reporting potential security vulnerabilities to Adobe, please visit the Adobe Bug Bounty Program for more information.

For more information, visit Adobe Security Bulletin and Advisories or email PSIRT@adobe.com.

CardTitle

APSB26-153

CardDescription

Priority 2 Security update

CardImage

Created

2026-10-13