Security update available for Adobe Commerce | APSB26-49
Bulletin ID
Date published
Priority
APSB26-49
May 12, 2026
2
style
grid width 12
Summary
Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves critical, important and moderate vulnerabilities. Successful exploitation could lead to arbitrary code execution, arbitrary file system write, application denial-of-service, and security feature bypass.
Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.
Affected versions
Product
Version
Priority rating
Platform
Adobe Commerce
2.4.9-beta1 2.4.8-p4 and earlier 2.4.7-p9 and earlier 2.4.6-p14 and earlier 2.4.5-p16 and earlier 2.4.4-p17 and earlier
2
All
Adobe Commerce B2B
1.5.3-beta1 1.5.2-p4 and earlier 1.4.2-p9 and earlier 1.3.4-p16 and earlier 1.3.3-p17 and earlier
2
All
Magento Open Source
2.4.9-beta1 2.4.8-p4 and earlier 2.4.7-p9 and earlier 2.4.6-p14 and earlier
2
All
style
grid width 12
Solution
Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version.
Vulnerability category: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Vulnerability impact: Arbitrary file system write Severity: Critical Authentication required to exploit? Yes CVSS base score: 8.7 CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N Notes:
Vulnerability category: Dependency on Vulnerable Third-Party Component (CWE-1395) Vulnerability impact: Application denial-of-service Severity: Important Authentication required to exploit? Yes CVSS base score: 5.3 CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Notes:
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79) Vulnerability impact: Arbitrary code execution Severity: Important Authentication required to exploit? Yes CVSS base score: 4.8 CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N Notes:
Vulnerability category: Improper Authorization (CWE-285) Vulnerability impact: Security feature bypass Severity: important Authentication required to exploit? Yes CVSS base score: 4.3 CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Notes:
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79) Vulnerability impact: Arbitrary code execution Severity: Important Authentication required to exploit? Yes CVSS base score: 4.8 CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N Notes:
You can control how Adobe websites use cookies and similar technologies by making choices below. But note that if you disable cookies and similar technologies entirely, Adobe websites may not function properly.
Cookies are small text files stored by your web browser when you use websites. There are also other technologies that can be used for similar purposes like HTML5 Local Storage and local shared objects, web beacons, and embedded scripts. These technologies help us do things like remembering you and your preferences when you return to our sites, measure how you use the website, conduct market research, and gather information about the ads you see and interact with.
You can make choices in the menu below about what cookies and other technologies you want us to use on Adobe sites when you visit them from this browser. You can always change those choices later by clicking on the Cookie Preferences link at the bottom of the page.
If enabled:
We can improve your experience by tailoring the site and the content to things we think might be of interest
We can better keep track of your preferences — like what language you prefer to use
We will better understand your likely interests so we can provide you more relevant Adobe ads and content on non-Adobe websites and in non-Adobe apps
It will help us improve the performance of our website and those of our partners who use the Adobe Experience Cloud
If disabled:
We won’t be able to remember you from session to session so the experience may not be tailored to your interests
You’ll still have access to the content of the site but certain features that depend on cookies may not function
You’ll still see ads, they just may not be as relevant to you
General information
You can control how Adobe websites use cookies and similar technologies by making choices below. But note that if you disable cookies and similar technologies entirely, Adobe websites may not function properly.
Cookies are small text files stored by your web browser when you use websites. There are also other technologies that can be used for similar purposes like HTML5 Local Storage, web beacons, and embedded scripts. These technologies help us do things like remembering you and your preferences when you return to our sites, measure how you use the website, conduct market research, and gather information about the ads you see and interact with.
You can make choices in the menu below about what cookies and other technologies you want us to use on Adobe sites when you visit them from this browser. You can always change those choices later by clicking on the Cookie Preferences link at the bottom of the page.
If enabled:
We can improve your experience by tailoring the site and the content to things we think might be of interest
We can better keep track of your preferences — like what language you prefer to use
We will better understand your likely interests so we can provide you more relevant Adobe ads and content on non-Adobe websites and in non-Adobe apps
It will help us improve the performance of our website and those of our partners who use the Adobe Experience Cloud
If disabled:
We won’t be able to remember you from session to session so the experience may not be tailored to your interests
We’ll still count your use of our site and services
You’ll still have access to the content of the site but certain features that depend on cookies may not function
You’ll still see ads, they just may not be as relevant to you
Operate the site and core servicesOperate site and measure engagement
Always active
These cookies are required, and they are used to enable the site and related services core functionality. Without them the site could not operate, so they cannot be disabled.
These cookies enable the site and related services’ core functionality and collect statistics about user engagement, such as counting active use to help us understand trends. These cookies cannot be disabled.
Measure performance
These cookies are used to analyze site usage to measure and improve performance. Without them Adobe cannot know what content is most valued and how often unique visitors return to the site, making it hard to improve information we offer to you.
These cookies are used to analyze site usage to measure and improve performance. Without them Adobe cannot know what content is most valued, making it hard to improve information we offer to you.
Extend functionality
These cookies are used to enhance the functionality of Adobe sites such as remembering your settings and preferences to deliver a personalized experience; for example, your username, your repeated visits, preferred language, your country, or any other saved preference.
Personalize advertising
These cookies are used to enable Adobe and our partners to serve ads more relevant to your interests. Without them you will still see ads, but they might not be as relevant to you.
