Adobe published APSB26-92 on August 11, 2026 — a Magento security update covering seven vulnerabilities across Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. It's rated Priority 2, Adobe's second-highest urgency level, and while no active exploitation has been reported yet, a couple of the issues in this batch are serious enough that store owners and anyone managing Magento 2 extensions should be paying attention now, not after a routine update cycle.

Here's what the advisory actually covers, and what it means if you're running third-party extensions alongside core Magento or Adobe Commerce.

What Got Patched

This Magento critical security update resolves a mix of critical, important, and moderate-severity issues. The most serious ones could allow an attacker to bypass security controls, execute arbitrary code, or escalate account privileges within the store.

  • 7 CVEs total. Five critical, one important, one moderate — spanning both core Magento and the Adobe Commerce B2B module.
  • No confirmed exploitation yet. Adobe reports no known active exploits at time of publication, though that window tends to close fast once a patch is public.
  • Applies broadly. This isn't a narrow, edge-case fix — it touches the July 2026 patch level and earlier across Adobe Commerce, Adobe Commerce B2B, and Magento Open Source.

Which Versions Are Affected

  • Adobe Commerce — versions 2.4.4 through 2.4.9 (July 2026 patch level and earlier).
  • Adobe Commerce B2B — versions 1.3.3 through 1.5.3 (July 2026 patch level and earlier).
  • Magento Open Source — versions 2.4.4 through 2.4.9 (July 2026 patch level and earlier).

If your store hasn't applied the August 2026 update, you're currently running an exposed version, this Adobe Commerce vulnerability set isn't limited to one edge case or one product line.

The One Worth Paying Closest Attention To

Of the seven CVEs patched, one stands well apart from the rest: a critical privilege-escalation flaw with a CVSS score of 9.1 that requires no authentication at all to exploit. That's the highest-risk category of vulnerability, since an attacker doesn't need a compromised account or any existing access to attempt it. The remaining critical issues, including two stored XSS vulnerabilities and a B2B-specific authorization bypass, do require some level of authenticated access, which narrows their real-world exploitability somewhat, though not enough to justify leaving them unpatched.

What This Means If You Run Third-Party Extensions

A core platform patch like this doesn't automatically break compatibility with well-maintained magento extensions, but it's still worth a quick check before and after updating.

  • Confirm extension compatibility with the patched Magento version before deploying to production.
  • Update extensi ons alongside the core patch where a compatible release is available, rather than leaving them on an older baseline.
  • Test checkout and admin workflows after patching, since security fixes occasionally touch authorization logic that extensions also hook into.
  • Review which extensions actually need admin-level access, given that several of this batch's vulnerabilities involve privilege escalation.

What to Do Right Now

  • Check your current version against the affected branches listed above.
  • Apply the August 2026 patch for your product line as soon as possible.
  • Stage before you deploy. Validate the update in a staging environment first, especially if you're running custom code or multiple extensions.
  • Run a quick Magento security audit of admin users and access roles once patched, given the privilege-escalation issues in this release.

Staying Ahead of the Next One

Following Magento security best practices isn't a one-time event tied to a single advisory — it's an ongoing habit of keeping core, extensions, and admin access reviewed on a regular cycle. As a Magento extension store, VDCstore keeps its listed Magento 2 extensions tested against current platform releases, so store owners aren't left guessing about compatibility every time Adobe ships a security update. If you're evaluating your store's current exposure or have questions about how this update affects an extension you're running, reach out and we'll help you sort it out.