Adobe Security Bulletin

Last updated on Aug 11, 2026

Security update available for Adobe Commerce | APSB26-73

Bulletin ID

Date published

Priority

APSB26-73

July 14, 2026

2

style

grid width 12

Summary

Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves critical, important and moderate vulnerabilities. Successful exploitation could lead to arbitrary code execution, privilege escalation, and security feature bypass.

Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.

Affected Versions

Product

Version

Priority rating

Platform

Adobe Commerce

2.4.9
2.4.8-p5 and earlier
2.4.7-p10 and earlier
2.4.6-p15 and earlier
2.4.5-p17 and earlier
2.4.4-p18 and earlier

2

All

Adobe Commerce B2B

1.5.3
1.5.2-p5 and earlier
1.4.2-p10 and earlier
1.3.4-p17 and earlier
1.3.3-p18 and earlier

2

All

Magento Open Source

2.4.9
2.4.8-p5 and earlier
2.4.7-p10 and earlier
2.4.6-p15 and earlier

2

All

Adobe Commerce Events

1.6.0 to 1.20.0

2

All

style

grid width 12

Solution

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version.

Product

Updated version

Platform

Priority rating

Installation instructions

Adobe Commerce

2.4.9-2026-jul
2.4.8-2026-jul
2.4.7-2026-jul
2.4.6-2026-jul
2.4.5-2026-jul
2.4.4-2026-jul

All

2

Release Notes

Adobe Commerce B2B

1.5.3-2026-jul
1.5.2-2026-jul
1.4.2-2026-jul
1.3.4-2026-jul
1.3.3-2026-jul

All

2

Release Notes

Magento Open Source

2.4.9-2026-jul
2.4.8-2026-jul
2.4.7-2026-jul
2.4.6-2026-jul

All

2

Release Notes

Adobe Commerce Events

1.21.0

All

2

Upgrade Modules and Extensions

style

grid width 12

Vulnerability Details

CVE-2026-48356

Vulnerability category: Unrestricted Upload of File with Dangerous Type (CWE-434)
Vulnerability impact: Privilege escalation
Severity: Critical
Authentication required to exploit? No
CVSS base score: 9.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Notes:

CVE-2026-48358

Vulnerability category: Improper Encoding or Escaping of Output (CWE-116)
Vulnerability impact: Arbitrary code execution
Severity: Critical
Authentication required to exploit? Yes
CVSS base score: 9.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Notes: Applies to webhooks only

CVE-2026-47994

Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Critical
Authentication required to exploit? Yes
CVSS base score: 8.7
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Notes:

CVE-2026-47988

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Security feature bypass
Severity: Critical
Authentication required to exploit? No
CVSS base score: 8.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Notes:

CVE-2026-47984

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Security feature bypass
Severity: Critical
Authentication required to exploit? No
CVSS base score: 8.2
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Notes:

CVE-2026-47995

Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Critical
Authentication required to exploit? Yes
CVSS base score: 8.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Notes: B2B

CVE-2026-47996

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Security feature bypass
Severity: Critical
Authentication required to exploit? Yes
CVSS base score: 7.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Notes:

CVE-2026-47992

Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Privilege escalation
Severity: Critical
Authentication required to exploit? Yes
CVSS base score: 7.2
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Notes:

CVE-2026-47997

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Security feature bypass
Severity: Important
Authentication required to exploit? No
CVSS base score: 5.9
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Notes:

CVE-2026-47998

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Security feature bypass
Severity: Important
Authentication required to exploit? No
CVSS base score: 5.9
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Notes:

CVE-2026-48371

Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
Authentication required to exploit? Yes
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Notes:

CVE-2026-47999

Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
Authentication required to exploit? Yes
CVSS base score: 4.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Notes:

CVE-2026-48000

Vulnerability category: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
Vulnerability impact: Security feature bypass
Severity: Moderate
Authentication required to exploit? Yes
CVSS base score: 4.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Notes:

CVE-2026-48001

Vulnerability category: Information Exposure (CWE-200)
Vulnerability impact: Security feature bypass
Severity: Moderate
Authentication required to exploit? No
CVSS base score: 3.7
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Notes:

Note

Authentication required to exploit: The vulnerability is (or is not) exploitable without credentials.

Exploit requires admin privileges: The vulnerability is (or is not) only exploitable by an attacker with administrative privileges.

style

xl spacing, one up, grid width 12, static-links, xxl-spacing-top

Acknowledgements

Adobe would like to thank the following researchers for reporting these issues and working with Adobe to help protect our customers:

0x0.eth - CVE-2026-47984, CVE-2026-47996
T.H. Lassche - CVE-2026-47988
Sudhanshu Rajbhar (sudi) - CVE-2026-47992
wohlie - CVE-2026-47994, CVE-2026-47995, CVE-2026-48358
akashhamal0x01 - CVE-2026-47997, CVE-2026-47998, CVE-2026-48001
s (howtoplay) - CVE-2026-47999
schemonah - CVE-2026-48000
Tseng, Ching-Yen (shaber) - CVE-2026-48371

NOTE: Adobe has a public bug bounty program with Intigriti. If you are interested in working with Adobe as an external security researcher, please check out https://app.intigriti.com/programs/adobe/adobepublic/detail.

For more information, visit https://www.adobe.com/trust/security/bug-bounty.html, or email PSIRT@adobe.com.

CardTitle

APSB26-73

CardDescription

Priority 2 Security update

CardImage

Created

2026-07-14

General information

Careers

Trust Center

Corporate responsibility

Legal

Security

Responsible AI

Accessibility

Transparency Center

Compliance

Privacy

Fraud Prevention

Adobe Security Bulletin

Last updated on Aug 11, 2026

Summary

Affected Versions

Solution

Vulnerability Details

Note

Acknowledgements