.

Adobe Security Bulletin

Last updated on Aug 18, 2026

Security update available for Adobe Commerce | APSB26-92

Bulletin ID
Date published
Priority
APSB26-92
August 11, 2026
2
style
grid width 12

Summary

Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves critical, important, and moderate vulnerabilities. Successful exploitation could result in security feature bypass, arbitrary code execution, and privilege escalation.

Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.

Affected Versions

Product
Version
Platform
Adobe Commerce

2.4.9-2026-jul and earlier

2.4.8-2026-jul and earlier

2.4.7-2026-jul and earlier

2.4.6-2026-jul and earlier

2.4.5-2026-jul and earlier

2.4.4-2026-jul and earlier

All
Adobe Commerce B2B

1.5.3-2026-jul and earlier

1.5.2-2026-jul and earlier

1.4.2-2026-jul and earlier

1.3.4-2026-jul and earlier

1.3.3-2026-jul and earlier

All
Magento Open Source

2.4.9-2026-jul and earlier

2.4.8-2026-jul and earlier

2.4.7-2026-jul and earlier

2.4.6-2026-jul and earlier

All
style
grid width 12

Solution

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version.

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version.

Product
Updated version
Platform
Priority rating
Installation instructions
Adobe Commerce
2.4.9-2026-aug
2.4.8-2026-aug
2.4.7-2026-aug
2.4.6-2026-aug
2.4.5-2026-aug
2.4.4-2026-aug
All
2
Release Notes for August 2026 security update APSB26-92
Adobe Commerce B2B
1.5.3-2026-aug
1.5.2-2026-aug
1.4.2-2026-aug
1.3.4-2026-aug
1.3.3-2026-aug
All
2
Release Notes for August 2026 security update APSB26-92
Magento Open Source
2.4.9-2026-aug
2.4.8-2026-aug
2.4.7-2026-aug
2.4.6-2026-aug
All
2
Release Notes for August 2026 security update APSB26-92
style
grid width 12

Vulnerability Details

Vulnerability category
Vulnerability impact
Severity
Authentication required to exploit?
Exploit requires admin privileges?
CVSS base score
CVSS vector
CVE number(s)
Notes
Incorrect Authorization (CWE-863)
Privilege escalation
Critical
No
No
9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVE-2026-71362
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Critical
Yes
Yes
7.7
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
CVE-2026-48414
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Critical
Yes
No
8.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVE-2026-48413
Incorrect Authorization (CWE-863)
Security feature bypass
Critical
Yes
No
7.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
CVE-2026-48415
B2B
Incorrect Authorization (CWE-863)
Security feature bypass
Critical
No
No
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE-2026-48416
Incorrect Authorization (CWE-863)
Security feature bypass
Important
Yes
Yes
6.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVE-2026-48411
Incorrect Authorization (CWE-863)
Privilege escalation
Moderate
Yes
Yes
2.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CVE-2026-48412

Note

Effective August 11, 2026, Adobe may assign a single CVE identifier to internally discovered vulnerabilities with the same severity rating and CWE category when a release includes systemic fixes.

Note

Authentication required to exploit: The vulnerability is (or is not) exploitable without credentials.

Exploit requires admin privileges: The vulnerability is (or is not) only exploitable by an attacker with administrative privileges.

style
xl spacing, one up, grid width 12, static-links, xxl-spacing-top

Acknowledgements

Adobe would like to thank the following researchers for reporting these issues and working with Adobe to help protect our customers:

  • wohlie — CVE-2026-48416, CVE-2026-48415, CVE-2026-48414, CVE-2026-48413
  • Akash Hamal (akashhamal0x01) — CVE-2026-48411
  • Ram Anuj (manual_mint) — CVE-2026-48412
  • 0x0.eth (0x0doteth) — CVE-2026-71362

NOTE: Adobe has a public bug bounty program with HackerOne. If you are interested in working with Adobe as an external security researcher, please check out https://app.intigriti.com/programs/adobe/adobepublic/detail.

For more information, visit https://www.adobe.com/trust/security/bug-bounty.html, or email PSIRT@adobe.com.

CardTitle
APSB26-92
CardDescription
Priority 2 Security update
CardImage
Adobe
Created
2026-08-11
Tags
caas:content-type/documentation,caas:trust-center/security-bulletin
PrimaryTag
caas:content-type/article
Details
caas:mnemonics/magento-commerce
Arbitrary
search: CVE-2026-71362 CVE-2026-48414 CVE-2026-48413 CVE-2026-48415 CVE-2026-48416 CVE-2026-48411 CVE-2026-48412