Adobe has released security update APSB26-153 for Adobe Commerce, Adobe Commerce B2B and Magento Open Source. The update, published on October 13, 2026, fixes 11 vulnerabilities that could lead to arbitrary code execution, privilege escalation, arbitrary file system write and security feature bypass. Adobe rates the update Priority 2 and recommends that merchants install the new builds on all supported release lines.
## Vulnerabilities addressed
Of the 11 vulnerabilities, five are rated Critical, five are rated High and one is rated Medium. Five can be exploited by an attacker who does not have an account on the affected store.
The most severe issue, CVE-2026-103849, is an improper neutralization of special elements in a template engine (CWE-1336). It can allow arbitrary code execution and carries a CVSS base score of 10.0. A second Critical issue, CVE-2026-92909, affects only the Adobe Commerce B2B module. It is an incorrect authorization flaw with a CVSS score of 9.8 that also requires no authentication.
Four of the vulnerabilities are stored cross-site scripting issues, and three are incorrect authorization flaws limited to the B2B module. Adobe states that it is not aware of any exploits in the wild for the issues covered by this bulletin.
## Affected and fixed versions
The update applies to Adobe Commerce 2.4.4 through 2.4.9, Adobe Commerce B2B 1.3.3 through 1.5.3 and Magento Open Source 2.4.6 through 2.4.9, on builds dated September 2026 and earlier. Fixed builds carry a 2026-oct label for each release line, for example 2.4.8-2026-oct. The fixes are also included in the first alpha releases of the next versions, Adobe Commerce 2.4.10-alpha1 and B2B 1.5.4-alpha1.
Magento Open Source 2.4.4 and 2.4.5 are not listed among the affected versions in this bulletin.
## September hotfix remains required
The bulletin also directs merchants to apply the hotfix released on September 7, 2026 under bulletin APSB26-146. That hotfix addresses CVE-2026-75650, a template engine injection rated CVSS 10.0, which Adobe confirmed was being exploited at the time of release. APSB26-146 carried a Priority 1 rating. The October builds do not include that hotfix, so it must be installed separately.
## Installation timeline
Under Adobe's priority ratings, Priority 2 updates should be installed within about 30 days of release. For APSB26-153, that period ends in mid-November 2026, shortly before the end-of-year retail season, when many online merchants limit changes to their production systems.
Installation instructions and package details are available in Adobe's release notes. The full bulletin is published at https://www.adobe.com/trust/security/products/commerce/apsb26-153.html, and the September hotfix is described at https://experienceleague.adobe.com/en/docs/commerce-knowledge-base/kb/announcements/commerce-apsb26-146.
