APSB26-92: What Every Adobe Commerce and Magento Store Owner Needs to Know

Key Takeaways

• APSB26-92 was released August 11, 2026, and patches 7 vulnerabilities (5 Critical) in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source.
• The standout issue is CVE-2026-71362, a CVSS 9.1 unauthenticated customer account takeover vulnerability.
• All supported release lines through the July 2026 patch level are affected; the fix brings stores to the "-2026-aug" version.
• The update ships as an isolated patch — apply it promptly, but check compatibility with cloud-patches and custom modules first.
• No known exploits in the wild yet, but merchants should treat that as a narrowing window, not a reason to delay.

If you run a store on Adobe Commerce or Magento Open Source, there's a new security bulletin you can't afford to ignore. On August 11, 2026, Adobe released APSB26-92, a Priority 2 security update that patches seven vulnerabilities — five of them rated Critical. The most serious of the group is an unauthenticated customer account takeover bug that requires no login, no admin access, and no user interaction to exploit.

This post breaks down what APSB26-92 actually fixes, who's affected, why the account takeover flaw is such a big deal, and exactly what steps you should take to protect your store.

What Is APSB26-92?

APSB26-92 is Adobe's regularly scheduled monthly security bulletin for Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The update fixes seven vulnerabilities, five of which are rated Critical, including CVE-2026-71362, an unauthenticated customer account takeover with a CVSS score of 9.1.

Unlike a full platform release, APSB26-92 ships as an isolated patch that stacks on top of July's update rather than as a brand-new version with fresh Composer packages. This approach reflects Adobe's current release cadence: starting in January 2026, Adobe Commerce moved to a monthly isolated security fixes schedule to deliver more frequent and predictable protection, a shift from the roughly five releases per year seen in 2024 and 2025.

Adobe has assigned the update a Priority 2 rating and recommends that merchants and store administrators update their installations to the latest available versions. Adobe has not reported any known exploits in the wild for the vulnerabilities addressed by this update — but that's not a reason to wait.

The Critical Vulnerability: Customer Account Takeover (CVE-2026-71362)

The headline issue in this release is a session-handling bug that lets an attacker hijack another shopper's account.

Security researchers who analyzed Adobe's patch traced the problem to Magento improperly handling customer identity within an account session, and confirmed that it lets an attacker switch a customer session to another customer's account — giving them access to the victim's account and private customer data. Because exploitation needs no existing account, administrator privileges, or user interaction, this isn't a theoretical risk reserved for sophisticated attackers. It's a low-effort, high-impact flaw that could expose saved addresses, order history, stored payment tokens, and other personal data for any customer on an unpatched store.

One independent researcher who reviewed the actual code diff described the root cause plainly: a Magento controller responsible for editing account data was populating the customer data object from session form data with no allowlist, meaning the application trusted input it shouldn't have.

Beyond the account takeover bug, the bulletin also addresses incorrect authorization vulnerabilities that could allow attackers to escalate privileges or bypass security features, along with stored cross-site scripting (XSS) issues that could potentially lead to arbitrary code execution. The remaining vulnerabilities in the patch cover additional stored cross-site scripting and authorization flaws.

Which Versions Are Affected?

APSB26-92 impacts every currently supported release line across all three Adobe Commerce product families. According to Adobe's advisory, the vulnerable versions include:

Adobe Commerce:

• 2.4.9-2026-jul and earlier
• 2.4.8-2026-jul and earlier
• 2.4.7-2026-jul and earlier
• 2.4.6-2026-jul and earlier
• 2.4.4-2026-jul and earlier

Adobe Commerce B2B:

• 1.5.3-2026-jul and earlier
• 1.5.2-2026-jul and earlier
• 1.4.2-2026-jul and earlier
• 1.3.4-2026-jul and earlier
• 1.3.3-2026-jul and earlier

Magento Open Source:

• 2.4.9-2026-jul and earlier
• 2.4.8-2026-jul and earlier
• 2.4.7-2026-jul and earlier
• 2.4.6-2026-jul and earlier

The security update applies to the latest supported release lines across Adobe Commerce, Adobe Commerce B2B, and Magento Open Source, bringing them up to the "-2026-aug" patch level. In short: if your store hasn't been patched since July 2026, it's exposed.

Why Adobe Released This as an "Isolated Patch"

If you've followed recent Adobe Commerce bulletins, you'll have noticed the term "Isolated patch" coming up often. Adobe releases these isolated patches specifically to help merchants apply fixes as promptly as possible, with fewer risks of delay caused by integration issues that can come with larger updates. This lets a store apply just the security fix without waiting on a full version upgrade cycle.

One important compatibility note for teams already running cloud infrastructure: if the fix is already included in the latest cloud-patches update, attempting to apply the isolated patch on top of it can cause installation failures. Always check which patching method your environment already uses before applying anything manually.

It's also worth knowing how Adobe's naming convention has evolved. Since Adobe moved to a monthly cadence in 2026, new patches are labeled by release month — for example, 2.4.9-2026-jul refers to the July 2026 bundle covered by APSB26-73. APSB26-92 follows the same pattern, updating everything to the "-2026-aug" label.

Step-by-Step: How to Patch Your Store Against APSB26-92

1. Identify your current version. Check your Magento/Adobe Commerce version string (e.g., 2.4.7-2026-jul) via the Admin panel or Composer's composer.json.
2. Compare against Adobe's bulletin. As of this release, the latest patched version is the "-2026-aug" build for your line.
3. Apply the isolated patch. To resolve the vulnerability, download and apply the isolated patch that corresponds to your specific Adobe Commerce or Magento Open Source version.
4. Watch for conflicts with third-party modules. Confirm the new patch is compatible with all installed third-party and custom modules to prevent functionality conflicts or downtime during deployment.
5. Verify coverage with the Commerce Version Tool. This standalone executable, included with each monthly security patch, helps merchants verify patch coverage by reporting which monthly security patches are installed, which are missing, and which CVEs the installation is protected against.
6. Contact support if you hit issues. Merchants who run into problems applying the security patch or isolated patch are encouraged to contact Adobe Support Services directly.

Should You Worry If You're on Cloud Infrastructure?

Yes — cloud-hosted stores are just as exposed as on-premises ones. The advisory applies across Adobe Commerce on Cloud infrastructure, Adobe Commerce on-premises deployments, and Magento Open Source alike. The only difference is how the fix reaches you: cloud customers may receive it automatically through a cloud-patches update, while on-premises and self-managed stores need to apply the isolated patch manually.

The Bigger Picture: Why This Matters for Merchant Trust

Security bulletins like APSB26-92 aren't just a developer chore — they're a trust issue. An account-takeover vulnerability, in particular, strikes at the heart of customer confidence: if shoppers can't trust that their saved data and order history are private, that erodes the relationship your brand has built with them.

As one advisory put it plainly: applying the latest Adobe Commerce and Magento Open Source security updates helps strengthen store security, protect sensitive information, and maintain customer trust. And while Adobe has reported no known active exploitation at the time of publication, that window rarely stays closed for long once a patch — and the vulnerability details it fixes — become public. Attackers routinely reverse-engineer patches to build working exploits within days of release, which is exactly why security researchers are already publishing technical breakdowns of the account-takeover flaw.

Final Word

If your Adobe Commerce or Magento Open Source store hasn't been updated since July 2026, patching against APSB26-92 should be at the top of your to-do list this week. Given the account takeover vulnerability requires zero authentication to exploit, every day your store runs unpatched is a day your customers' account data is exposed to anyone who knows how to read a public patch diff. Check your version, apply the isolated patch, verify with the Commerce Version Tool, and — if anything looks off — get Adobe Support involved before it becomes a bigger problem.

For the official technical details, always refer to Adobe's Security Bulletin APSB26-92 on helpx.adobe.com.