Adobe Commerce Security Update APSB26-153: October 2026 Patch Guide

What is APSB26-153? APSB26-153 is Adobe’s security bulletin for Adobe Commerce, Adobe Commerce B2B and Magento Open Source, published on 13 October 2026. It fixes 11 vulnerabilities (5 critical, 5 high, 1 medium) that could lead to code execution, privilege escalation, file system write or security feature bypass. Adobe rates it Priority 2 and says it knows of no exploits in the wild.

If you run a Magento 2 store, this is the Adobe Commerce security update APSB26-153 you need to plan for this week. Below you will find what changed, which versions are affected, what the 11 CVEs actually do, how to check your store, and how to install the patch without tripping over the usual mistakes. Everything here comes from Adobe’s own bulletin and knowledge base article, linked at the end.

Quick answers

• Is APSB26-153 critical? It contains five critical vulnerabilities, but Adobe’s overall bulletin priority is 2.
• Is it being exploited? Adobe states it is not aware of any exploits in the wild for the issues in this update.
• Is Magento Open Source 2.4.6 patched? No. Adobe lists no October fix for Open Source 2.4.6, so that line has to move to 2.4.7 or later.
• How do I check my store? Run php vendor/bin/patch-status from the project root (on-premises) or vendor/bin/magento-patches -n status (cloud).
• Do I need anything else? Yes. Adobe also expects the APSB26-146 hotfix for CVE-2026-75650 to be applied.

Key facts at a glance

• Bulletin: APSB26-153, “Security update available for Adobe Commerce”
• Published: 13 October 2026 (Adobe’s knowledge base article was last updated 14 October 2026)
• Adobe priority: 2
• Vulnerabilities: 11 in total: 5 critical, 5 high, 1 medium
• Affected: Adobe Commerce 2.4.4 to 2.4.9, Adobe Commerce B2B 1.3.3 to 1.5.3, Magento Open Source 2.4.6 to 2.4.9, all at “2026-sep and earlier”
• Fixed in: the 2026-oct releases, plus 2.4.10-alpha1 and B2B 1.5.4-alpha1
• Exploitation status: Adobe is not aware of any exploits in the wild for this update
• Companion fix: apply the APSB26-146 hotfix for CVE-2026-75650 as well

What APSB26-153 is and why it matters

APSB26-153 is Adobe’s October 2026 security update for its Commerce product family, and it matters because it fixes flaws that include unauthenticated code execution. It is not a feature release. It is a set of isolated security patches that close specific weaknesses.

Adobe’s summary says the update resolves critical, high and medium vulnerabilities that could lead to arbitrary code execution, privilege escalation, arbitrary file system write and security feature bypass. Those are the outcomes that turn a normal storefront into a compromised one: an attacker who can run code on the server, or take over an admin session, can read customer data, change payment pages or plant a backdoor.

Two points about how Adobe delivers this release are easy to miss. First, it ships as isolated patch files, not as new Composer packages. Adobe has not published Composer packages for this release. Second, the patches build on earlier monthly patches, so a store that skipped a previous month cannot simply drop this one in.

One more thing to keep in mind is the label “Priority 2”. That is Adobe’s own rating for how urgently the patch should be applied. Our own view, stated plainly as our advice and not Adobe’s, is that a release containing five critical CVEs, including unauthenticated ones, deserves patching within days rather than waiting for the longest window your change process allows.

Affected and fixed versions

Every supported line of Adobe Commerce, Adobe Commerce B2B and Magento Open Source at the 2026-sep level or earlier is affected, and the fix is in the matching 2026-oct release. The only gap is Magento Open Source 2.4.6, which has no October fix.

Magento Open Source 2.4.6 is the exception. Adobe lists no October fix for it, so merchants on that line must move to 2.4.7 or later to be covered. Adobe also notes that Open Source merchants can download only 2.4.7 or later, while Adobe Commerce merchants on 2.4.6 or earlier need Composer keys (the public key is the username and the private key is the password).

Isolated patch files

For on-premises installations, Adobe’s knowledge base article lists these isolated patch ZIP files: 2-4-9-oct-2026.zip (2.4.9), 2-4-8-p5-oct-2026.zip, 2-4-7-p10-oct-2026.zip, 2-4-6-p15-oct-2026.zip, 2-4-5-p17-oct-2026.zip and 2-4-4-p18-oct-2026.zip. For 2.4.10-alpha1, Adobe points to the cloud-patches release notes.

Patch files follow the naming pattern <version>-<YYYY>-<MM>-<seq>-<COMPONENT>. A single ZIP can hold separate files for CE, EE, B2B and PageBuilder. You apply only the files that match the components you actually have installed.

All 11 vulnerabilities in APSB26-153

The 11 CVEs split into 5 critical, 5 high and 1 medium, and three of the high and critical ones apply only to Adobe Commerce B2B. The table below lists each one with the details Adobe published.

The five critical vulnerabilities in plain English

CVE-2026-103849 (CVSS 10.0). This is a template engine injection flaw that can lead to arbitrary code execution without authentication. Adobe’s vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, which reads as: reachable over the network, low complexity, no privileges, no user interaction, changed scope, and high impact on confidentiality, integrity and availability. It applies to all products, not only B2B. In practical terms, this is the one to treat as the headline of the bulletin.

CVE-2026-92909 (CVSS 9.8). An incorrect authorization flaw that allows arbitrary code execution without authentication. It applies to Adobe Commerce B2B only. If you run B2B, this is a second unauthenticated code execution path on top of CVE-2026-103849.

CVE-2026-91013 and CVE-2026-100133 (both CVSS 9.3). Two stored cross-site scripting flaws that lead to privilege escalation. Neither needs the attacker to be logged in, but both need user interaction, meaning someone has to load the affected content. Stored XSS in a store context is serious because the injected script runs in the browser of whoever views it, which can include an administrator.

CVE-2026-92464 (CVSS 9.1). An improper input validation flaw that can lead to arbitrary code execution. The attacker needs high privileges, so this is mostly a concern where admin accounts are shared, weakly protected or already compromised. It is still rated critical because of what the attacker gains.

What the high and medium issues add

The five high-severity issues cover another stored XSS leading to code execution (CVE-2026-92911), an arbitrary file system write through improper input validation (CVE-2026-95631), a privilege escalation via stored XSS (CVE-2026-92922), and two B2B authorization bypasses (CVE-2026-92908 and CVE-2026-92910). The single medium issue, CVE-2026-95630, is a security feature bypass caused by improper input validation and needs authentication.

B2B-specific risks

Three of the 11 vulnerabilities apply only to Adobe Commerce B2B: CVE-2026-92909, CVE-2026-92908 and CVE-2026-92910. All three are incorrect authorization problems, which means the software fails to check properly whether a user is allowed to do something.

CVE-2026-92909 is the one that stands out. It is critical (9.8) and needs no authentication, and it leads to arbitrary code execution. The other two are high severity security feature bypasses: CVE-2026-92908 (8.3, authentication needed) and CVE-2026-92910 (7.2, no authentication).

A common misreading is that the unauthenticated code execution in this bulletin is a B2B-only problem. It is not. CVE-2026-103849 is unauthenticated, rated 10.0, and applies to all products. Only CVE-2026-92909 is B2B-specific. B2B merchants therefore face both, while Adobe Commerce and Open Source merchants without B2B face CVE-2026-103849 and the other “All” items.

The B2B module has its own fixed versions (see the table above), and its patch files are applied after the CE and EE files in the correct order. Do not assume the core patch covers B2B.

Relationship to APSB26-146 and CVE-2026-75650

APSB26-153 is not a replacement for APSB26-146. Adobe expects you to apply the hotfix for CVE-2026-75650 in addition to this update, so treat the two as a pair.

APSB26-146 was released on 7 September 2026 and is rated critical. CVE-2026-75650 carries a CVSS score of 10.0 and is a template-engine flaw. Singapore’s Cyber Security Agency alert AL-2026-117, dated 9 September 2026, says it is “reportedly being actively exploited”.

This is where precision matters, so here is the separation in one place:

• CVE-2026-75650 (APSB26-146, September 2026): active exploitation has been reported, per the Singapore CSA alert.
• The 11 vulnerabilities in APSB26-153 (October 2026): Adobe states it is not aware of any exploits in the wild.

We are not claiming that anything in APSB26-153 is being exploited. We are saying that a store which has not applied the September hotfix has a separate and reportedly exploited problem that this October patch does not remove. The hotfix steps are in Adobe’s knowledge base article for APSB26-146, and the bulletin itself is on Adobe’s security site.

Are you vulnerable? How to check your store

The fastest way to know is to run Adobe’s Commerce Version Tool from your project root. It reports which patches are applied and which are missing, and gives a per-CVE status of PROTECTED, VULNERABLE or UNKNOWN.

On a standard on-premises or Open Source installation, run:

php vendor/bin/patch-status

On Adobe Commerce on cloud, Adobe’s alternative is the Quality Patches Tool:

vendor/bin/magento-patches -n status

One catch: the Commerce Version Tool ships only in the July 2026 isolated patch. If patch-status is missing on your store, apply the July 2026 patch first, then run it. Treat UNKNOWN as “not confirmed safe”, and read the missing-patch list before you decide anything. If the tool shows VULNERABLE for CVE-2026-103849, move that store to the top of your queue.

If you cannot run the tool, a manual fallback is to compare your installed version and patch level against the fixed-versions table above. A store on “2026-sep and earlier” is affected.

How to install APSB26-153

Install APSB26-153 by confirming your prerequisites, testing on staging, applying the isolated patch files in the correct order, and verifying the result. For anything not spelled out below, follow Adobe’s official instructions rather than improvising.

On-premises and Magento Open Source

Adobe’s knowledge base article sets these requirements: be on the latest security-only (-p) release of your line, already have all earlier monthly isolated patches applied in release order, and also apply the CVE-2026-75650 hotfix.

1. Back up first. Take a full backup of the code and the database, and confirm you can restore it. Adobe’s instructions govern the details of how.
2. Work on staging. Apply everything on a staging copy that matches production, and test before touching the live store.
3. Confirm prerequisites. Check that you are on the latest -p release of your line and that every earlier monthly isolated patch is already in place. If the Commerce Version Tool is missing, apply the July 2026 patch first.
4. Download the right ZIP. Pick the file for your version from the list above. Remember the Composer key rule for Adobe Commerce on 2.4.6 or earlier, and that Open Source downloads start at 2.4.7.
5. Apply in the correct order. Apply CE files first, then EE, then B2B, doing the previous month first and then the current month. Apply only the files matching components you have installed.
6. Apply the hotfix. Add the CVE-2026-75650 hotfix from the APSB26-146 knowledge base article.
7. Follow Adobe’s apply procedure. Use Adobe’s support article “How to apply an Isolated security patch file” for the exact commands. We do not reproduce them here, because the correct steps depend on your setup.
8. Flush caches. Clear the Magento cache and any full-page or CDN cache layers you run, as your deployment process normally does.
9. Verify. Run php vendor/bin/patch-status and confirm the CVEs show PROTECTED. Then run your regression checks on checkout, login, admin and any B2B flows.
10. Roll out to production. Repeat the verified steps on the live store, ideally in a low-traffic window.
11. Rotate keys. Adobe strongly recommends rotating encryption keys and associated credentials. Follow Adobe’s documentation for how.

Adobe Commerce on cloud

On cloud, the fix is delivered through the latest cloud-patches update, and you apply it using Magento Cloud Patches. This is the key difference from on-premises: the fix is already in the latest cloud-patches package, so applying the isolated patch on top can cause installation failures.

1. Back up and work in an integration or staging environment first.
2. Update to the latest cloud-patches release and deploy through your normal pipeline.
3. Do not also apply the isolated ZIP manually when the fix is already present.
4. Run vendor/bin/magento-patches -n status to check what is applied and what is missing.
5. Apply the CVE-2026-75650 hotfix if it is not already in place.
6. Test, flush caches, then promote to production.
7. Rotate encryption keys and related credentials per Adobe’s guidance.

For 2.4.10-alpha1, Adobe refers to the cloud-patches release notes.

Common mistakes to avoid

Most failed or incomplete patching comes from four mistakes, and all four are avoidable if you check them before you start.

Double-applying the patch on cloud

On Adobe Commerce on cloud, the fix is already in the latest cloud-patches update. Adobe warns that applying the isolated patch when the fix is already present can cause installation failures. Use Magento Cloud Patches and check status with vendor/bin/magento-patches -n status.

Skipping earlier monthly patches

The isolated patches must be applied in release order. If a previous month is missing, the October files may not apply cleanly, or you may think you are covered when you are not. Check what is already installed before you start.

Applying the wrong component file

One ZIP can hold separate CE, EE, B2B and PageBuilder files. Apply only those that match your installed components, in the order CE, EE, then B2B. Applying a B2B file to a store without B2B, or forgetting the B2B file on a store that has it, leaves you wrong or exposed.

Forgetting the CVE-2026-75650 hotfix

APSB26-153 does not replace the September fix. Adobe expects the APSB26-146 hotfix in addition. Because CVE-2026-75650 has been reportedly exploited, this is the omission we would worry about most.

Post-patch checklist

After patching, confirm three things: the tool reports your CVEs as protected, the store still works end to end, and your credentials have been rotated. Use this list:

• Backup taken and restore confirmed before changes began.
• Patch tested on staging, then applied to production.
• CE, EE and B2B files applied in the right order, previous month first.
• CVE-2026-75650 hotfix applied.
• Caches flushed, including any full-page and CDN layers.
• php vendor/bin/patch-status (or vendor/bin/magento-patches -n status on cloud) shows the October CVEs as PROTECTED, with nothing left as VULNERABLE or UNKNOWN that you have not investigated.
• Checkout, customer login, admin login and B2B flows tested.
• Encryption keys and associated credentials rotated, as Adobe strongly recommends.
• Admin accounts reviewed, with high-privilege access limited to people who need it. Several of these CVEs require high privileges, so tidy admin access reduces exposure.
• Patch date and versions recorded for your next audit.

When to get professional help

You can apply this patch in-house if your team is comfortable with Composer, staging and release management. Consider outside help if you are several monthly patches behind, run a heavily customised store, are on Open Source 2.4.6 and need to move to 2.4.7 or later, or cannot afford a failed deployment.

WebbyTroops is a Magento development team. We do not run a dedicated security-patching product page, and we are not going to promise fixed turnaround times or outcomes here. What we can say is that our Magento developers work with Magento 2 stores day to day, and patching, version moves and testing are normal engineering work for a team like that. The scope and cost depend on your version, your extensions and your hosting, so they are agreed case by case.

If you want a hand, you can start with our Magento development services, bring in extra capacity through hire Magento developers, or, if your store sits on a much older setup and needs a bigger move, read about our Magento 2 migration services. If you are unsure where you stand, tell us your Magento version and hosting, and we will say honestly what is involved.

Frequently asked questions

What is APSB26-153?

APSB26-153 is Adobe’s security bulletin titled “Security update available for Adobe Commerce”, published on 13 October 2026. It covers Adobe Commerce, Adobe Commerce B2B and Magento Open Source, and fixes 11 vulnerabilities: five critical, five high and one medium. The flaws could lead to code execution, privilege escalation, file system write or security feature bypass.

Is APSB26-153 critical?

The bulletin contains five critical vulnerabilities, with CVSS scores from 9.1 to 10.0, so the content is serious. Adobe’s own priority rating for the update is Priority 2. As our advice rather than Adobe’s, we suggest patching within days, especially because CVE-2026-103849 is unauthenticated and applies to all products.

Is APSB26-153 being exploited in the wild?

Adobe states it is not aware of any exploits in the wild for the issues addressed in APSB26-153. Active exploitation was reported only for CVE-2026-75650, fixed in the separate September bulletin APSB26-146. Apply that hotfix as well, because the two updates cover different vulnerabilities and one does not replace the other.

Which Magento versions are affected?

Adobe Commerce 2.4.4 to 2.4.9, Adobe Commerce B2B 1.3.3, 1.3.4, 1.4.2, 1.5.2 and 1.5.3, and Magento Open Source 2.4.6 to 2.4.9 are affected at the 2026-sep level and earlier. Fixes are in the matching 2026-oct releases and in 2.4.10-alpha1 for Commerce and Open Source, and 1.5.4-alpha1 for B2B.

Is Magento Open Source 2.4.6 patched?

No. Adobe lists no October fix for Magento Open Source 2.4.6. Merchants on that line need to move to 2.4.7 or later, where the 2026-oct fix is available. Open Source merchants can download only 2.4.7 or later, so plan the version move and test it on staging before production.

How do I check if my store is patched?

Run php vendor/bin/patch-status from your project root. Adobe’s Commerce Version Tool lists applied and missing patches and reports each CVE as PROTECTED, VULNERABLE or UNKNOWN. On Adobe Commerce cloud, you can use vendor/bin/magento-patches -n status. The tool ships only in the July 2026 isolated patch, so apply that first if it is missing.

How do I install APSB26-153?

On-premises and Open Source stores apply Adobe’s isolated patch files in order: CE, then EE, then B2B, previous month first. You must already be on the latest -p release with earlier monthly patches applied, and you must also apply the CVE-2026-75650 hotfix. Back up, test on staging, flush caches, verify, then rotate keys.

Do I apply the patch manually on Adobe Commerce cloud?

Not if the fix is already present. On cloud, the fix is in the latest cloud-patches update, and applying the isolated patch on top can cause installation failures. Use Magento Cloud Patches, then check with vendor/bin/magento-patches -n status to see what is applied and what is missing before you deploy.

Should I rotate encryption keys after patching?

Adobe strongly recommends rotating encryption keys and associated credentials as part of remediation, and notes that unpatched systems remain vulnerable. Follow Adobe’s official documentation for the rotation procedure, and plan it alongside the patch so you do not leave old credentials in place after the code is fixed.

Conclusion

APSB26-153 is a significant but manageable update. Eleven vulnerabilities are fixed, five of them critical, and the most serious, CVE-2026-103849, is unauthenticated and affects every product. Adobe reports no known exploits for this update, but the September CVE-2026-75650 hotfix is a separate, reportedly exploited issue that you should not skip. Check your store with the patch-status tool, patch on staging first, apply the files in order, and rotate your keys.

If you would like a second pair of eyes on your Magento 2 store, you can contact the WebbyTroops team or write to [email protected] with your Magento version and hosting setup.