Adobe released a security update for Adobe Commerce, Adobe Commerce B2B, and Magento Open Source on August 11, fixing seven vulnerabilities, four of them rated critical. One flaw can be exploited without any login credentials, according to Adobe's published bulletin, prompting security researchers to flag the update as a priority for store operators running the affected software.
What Adobe fixed
The most severe issue, tracked as CVE-2026-71362, is an incorrect authorization vulnerability scoring 9.1 on the CVSS v3.1 scale. It requires no authentication and no administrative access to exploit. Two additional critical-rated issues involve stored cross-site scripting bugs capable of leading to arbitrary code execution, and a separate authorization flaw affecting the Commerce B2B module allows a security feature bypass. Adobe states it has no evidence of active exploitation at the time of publication.
Affected versions
The update applies to:
Adobe Commerce and Magento Open Source on version 2.4.9-2026-jul and earlier
Adobe Commerce B2B on versions 1.3.3 through 1.5.3 (2026-jul builds and earlier)
Deployments on both Cloud infrastructure and on-premises environments
Full technical detail, including CVSS scoring and affected component lists, is available in Adobe's official security bulletin.
A change in patch delivery
This release marks a departure from Adobe's usual monthly process. Rather than distributing the fix as a Composer package, Adobe classified the August update as an Isolated security patch. Under this model, the fix ships as a downloadable file that must be applied directly rather than through a dependency manager. Installation only succeeds if a store already runs the latest security-only release for its version line, with every prior monthly patch already applied in sequence.
Verification tooling
Adobe includes a Commerce Version Tool with the release, allowing store operators to check which patches are already installed and which CVEs remain unaddressed. The tool becomes available once a required component patch has been applied, and Adobe's documentation describes it as covering both on-premises and Cloud infrastructure environments.
Industry response
The update has drawn attention from Magento and Adobe Commerce service providers because of the unauthenticated nature of the primary flaw and the change in how the patch is distributed. Store operators managing customized deployments, including third-party extensions, checkout modifications, or payment gateway integrations, are advised to test the patch in a staging environment before applying it to a live store, since Adobe's fix does not account for compatibility with custom code.
Security researchers note that unauthenticated privilege escalation vulnerabilities in widely used e-commerce platforms tend to draw exploitation attempts quickly once patches are public, making early adoption a meaningful factor in reducing exposure.
Background
Adobe issues security bulletins for its Commerce platform on a regular monthly cadence, addressing vulnerabilities discovered through its own testing and through external security research. The August release follows a July bulletin, APSB26-73, which addressed a separate set of critical vulnerabilities across the same platform family.
