On October 13, 2026, Adobe published APSB26-153, a Priority 2 Magento security update for Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. It resolves 11 vulnerabilities, and five carry a critical rating. If your store is on an affected version, this Adobe Commerce security patch should move to the top of your task list. This guide covers what changed, why waiting is risky, how to plan the update around your extensions, and how VDCStore can help.

The Update at a Glance

The update fixes issues that could allow arbitrary code execution, privilege escalation, arbitrary file system write, and security feature bypass. In short:

  • Reference: APSB26-153, dated October 13, 2026, rated Priority 2 by Adobe.
  • Total fixes: 11 vulnerabilities, made up of five critical, five high, and one medium.
  • Worst case: CVE-2026-103849 scores a CVSS 10.0 and can result in arbitrary code execution.
  • In the wild: Adobe reports no known exploits for these issues at the time of writing.

Every Issue in the Bulletin, by Severity

Here is each vulnerability that Adobe lists, grouped by severity.

Critical

  • CVE-2026-103849 (CVSS 10.0): template engine injection that can lead to arbitrary code execution. No login required.
  • CVE-2026-92909 (CVSS 9.8): incorrect authorization that can lead to arbitrary code execution. No login required. Affects B2B.
  • CVE-2026-91013 (CVSS 9.3): stored cross-site scripting that can lead to privilege escalation. No login required.
  • CVE-2026-100133 (CVSS 9.3): stored cross-site scripting that can lead to privilege escalation. No login required.
  • CVE-2026-92464 (CVSS 9.1): improper input validation that can lead to arbitrary code execution. Login required.

High

  • CVE-2026-92911 (CVSS 8.7): stored cross-site scripting that can lead to arbitrary code execution. Login required.
  • CVE-2026-95631 (CVSS 8.7): improper input validation that can lead to an arbitrary file system write. Login required.
  • CVE-2026-92908 (CVSS 8.3): incorrect authorization that can lead to a security feature bypass. Login required. Affects B2B.
  • CVE-2026-92922 (CVSS 8.1): stored cross-site scripting that can lead to privilege escalation. Login required.
  • CVE-2026-92910 (CVSS 7.2): incorrect authorization that can lead to a security feature bypass. No login required. Affects B2B.

Medium

  • CVE-2026-95630 (CVSS 4.3): improper input validation that can lead to a security feature bypass. Login required.

Understanding the Vulnerability Types

  • Template engine injection: user input ends up inside a template that the server processes, which can let an attacker run code.
  • Incorrect authorization: the application does not properly check whether someone may perform an action.
  • Stored XSS: a harmful script is saved in the store and runs when another person, such as an admin, loads the page.
  • Improper input validation: the application accepts data that should have been blocked.

A note on the "login required" label: those issues still matter. An attacker who already has a low-privilege account, or who can reach an admin session, can use them to go further than they should.

Versions in Scope

  • Adobe Commerce: 2.4.4 to 2.4.9, up to the 2026-sep releases.
  • Adobe Commerce B2B: 1.3.3, 1.3.4, 1.4.2, 1.5.2, and 1.5.3, up to the 2026-sep releases.
  • Magento Open Source: 2.4.6 to 2.4.9, up to the 2026-sep releases.

Why Waiting Is Risky

Some updates can sit in a backlog for a few weeks. This is not one of them. Consider the following:

  • No login required: four critical issues (CVE-2026-103849, CVE-2026-92909, CVE-2026-91013, and CVE-2026-100133) can be exploited without authentication, and so can the high-severity CVE-2026-92910.
  • Privilege escalation through XSS: multiple stored cross-site scripting flaws are in the bulletin, and they can lead to privilege escalation.
  • Three B2B issues: stores that use Adobe Commerce B2B are directly affected by CVE-2026-92909, CVE-2026-92908, and CVE-2026-92910.
  • Fixes are visible to everyone: when a bulletin goes public, attackers can study the changes. The longer a store stays unpatched, the more exposed it is.
  • A linked hotfix: Adobe asks merchants to apply the CVE-2026-75650 hotfix from APSB26-146 (released September 7, 2026) alongside this update.

A successful attack can mean stolen customer data, a disrupted checkout, and a long recovery. Compared with that, a planned update is a small and predictable job.

What Adobe Wants You to Install

Adobe recommends moving to the newest version for your product line:

  • Adobe Commerce: any of the 2026-oct releases for 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, and 2.4.9, plus 2.4.10-alpha1.
  • Adobe Commerce B2B: the 2026-oct releases for 1.3.3, 1.3.4, 1.4.2, 1.5.2, and 1.5.3, plus 1.5.4-alpha1.
  • Magento Open Source: the 2026-oct releases for 2.4.7, 2.4.8, and 2.4.9, plus 2.4.10-alpha1.

One detail to note: Magento Open Source 2.4.6 is listed as affected, yet the updated Open Source versions start at 2.4.7. Stores on 2.4.6 should plan an upgrade. The 2.4.10-alpha1 build is an early alpha, so most live stores will choose the 2026-oct release for the version they already run.

A Safe Update Checklist

  • Take a full backup: files and database, before anything else.
  • Start on staging: apply the update to a copy of your store first.
  • Include the earlier hotfix: make sure the CVE-2026-75650 hotfix is in place too.
  • Run through key journeys: test checkout, payments, accounts, admin tasks, and B2B ordering.
  • Release at a quiet time: choose a low-traffic window and keep a rollback plan handy.
  • Watch closely afterwards: review logs, errors, and admin activity once the update is live.

Extensions and Custom Code: Test Before You Go Live

Core updates are only half the story. Magento Extensions and custom modules often touch checkout, pricing, customer accounts, and the admin, which are exactly the areas that matter most after a security update. Before you release, confirm that every installed extension still works on the updated version, and check that none of them has been waiting on a compatibility fix of its own. Stores that skip this step are the ones that discover problems from customers instead of from testing.

After the Update: What to Check

  • Version number: confirm the store now reports the 2026-oct release you intended to install.
  • Admin users: review the list of admin accounts for anything unexpected.
  • Key pages: walk through the storefront, cart, and checkout as a customer would.
  • Logs: look for new errors in the first hours and days after release.

Read More :APSB26-146: An Active Adobe Commerce Zero-Day — What Store Owners Must Do

How VDCStore Can Help

The VDCStore team works with Magento stores and their extensions every day. For APSB26-153, we can help you:

  • Confirm your version: identify the exact Adobe Commerce, B2B, or Open Source release you are running.
  • Plan the update: map out the patch, the earlier hotfix, and any upgrade your version needs.
  • Check extension compatibility: test your installed extensions against the updated release on staging.
  • Go live with confidence: deploy with a tested process and a rollback plan.

Quick Answers

How do I find my version? Run bin/magento --version on the server, or ask your developer to confirm it from your installation.

What if I am on Magento Open Source 2.4.6? It is listed as affected, but the updated Open Source versions start at 2.4.7, so plan an upgrade.

Is the earlier hotfix still required?Yes. Adobe asks you to apply the CVE-2026-75650 hotfix as well.

Does this bulletin cover Shopify?No. It applies only to Adobe Commerce, Adobe Commerce B2B, and Magento Open Source.

Final Thoughts

APSB26-153 is a priority release for every store on an affected Adobe Commerce, B2B, or Magento Open Source version. With no exploits reported yet, the best moment to act is now. Contact VDCStore to get APSB26-153 applied to your store.