On 13 October 2026 Adobe released security bulletin APSB26-153 for Adobe Commerce, Adobe Commerce B2B and Magento Open Source. It fixes 11 CVEs, five rated Critical. The top one, CVE-2026-103849, is a template engine injection with a CVSS score of 10.0 that Adobe marks as not requiring authentication.
Adobe says it is not aware of exploits in the wild for these issues and rates the update priority 2. That calm framing deserves context: CISA added two other Adobe Commerce bugs to its Known Exploited Vulnerabilities catalog in September 2026 (CVE-2026-75650 on 8 September and CVE-2026-71362 on 24 September). Magento stores are a frequent target, and pre-auth code execution bugs tend not to stay quiet for long.
What's affected
Per the bulletin, every supported line is affected up to its September 2026 security release:
- Adobe Commerce: 2.4.4 through 2.4.9, versions labeled "2026-sep and earlier". Fixed in the matching "2026-oct" release (for example 2.4.9-2026-oct) or 2.4.10-alpha1.
- Adobe Commerce B2B: 1.3.3, 1.3.4, 1.4.2, 1.5.2 and 1.5.3, "2026-sep and earlier". Fixed in the "2026-oct" releases or 1.5.4-alpha1.
- Magento Open Source: 2.4.6 through 2.4.9, "2026-sep and earlier". Fixed in 2.4.7-2026-oct, 2.4.8-2026-oct, 2.4.9-2026-oct or 2.4.10-alpha1.
Note that last line carefully. Magento Open Source 2.4.6 is listed as affected, but the bulletin's solution table has no 2.4.6 fixed release for Open Source. If you run 2.4.6 on Open Source, the path is an upgrade to a supported line.
The Critical CVEs:
| CVE | Weakness | Impact | Auth required | CVSS |
|---|---|---|---|---|
| CVE-2026-103849 | Template engine injection (CWE-1336) | Arbitrary code execution | No | 10.0 |
| CVE-2026-92909 | Incorrect authorization (CWE-863), B2B | Arbitrary code execution | No | 9.8 |
| CVE-2026-91013 | Stored XSS (CWE-79) | Privilege escalation | No | 9.3 |
| CVE-2026-100133 | Stored XSS (CWE-79) | Privilege escalation | No | 9.3 |
| CVE-2026-92464 | Improper input validation (CWE-20) | Arbitrary code execution | Yes | 9.1 |
The remaining six are High or Medium, including CVE-2026-95631, an authenticated arbitrary file system write rated 8.7.
There is one more instruction in the bulletin that is easy to miss: "Please apply the Hotfix for CVE-2026-75650 in addition to the security updates released in this bulletin." That is the September bug from APSB26-146 that CISA lists as exploited. The October release does not replace it.
How to check if you're exposed
On each store, check the installed version and whether the September hotfix is present:
bin/magento --version
# Composer view of the core package
composer show magento/product-community-edition 2>/dev/null | grep -E '^versions'
composer show magento/product-enterprise-edition 2>/dev/null | grep -E '^versions'
If your release is labeled 2026-sep or earlier, you are affected. If your B2B module is enabled, CVE-2026-92909 applies too. For hosted or agency managed stores, ask for the exact release string and the date the CVE-2026-75650 hotfix was applied. "We patch monthly" is not an answer.
While you are in there, review admin users and recent changes to CMS blocks, email templates and widgets. Template injection and stored XSS bugs leave traces in content, not just in code.
What to do now
- Apply the 2026-oct release for your line in staging, run your checkout and admin smoke tests, then deploy to production. Do not wait for the next maintenance window for a pre-auth CVSS 10.0.
- Confirm the CVE-2026-75650 hotfix from APSB26-146 is applied, as the bulletin requires. Apply it now if it is not.
- Plan an upgrade off Magento Open Source 2.4.6, which has no fixed release listed in APSB26-153.
- Put a WAF rule set in front of the store while you test, and watch logs for unusual requests to template rendering and B2B endpoints.
- Rotate admin and integration credentials if you find unexplained admin accounts, template changes or unknown files in
pub/andvar/. - Check third party extensions. Composer dependencies from marketplace vendors run with the same privileges as core code, so include them in the same patch cycle.
Why it matters
Commerce platforms concentrate payment pages, customer data and admin access in one PHP application with a large extension surface. A template injection there is not a rendering glitch. It is a path to server side code execution, and on a store, code execution can end in skimming code on the checkout page.
The hotfix requirement is the operational lesson. In this cycle the fixes arrive in two forms: the dated 2026-oct security releases and a separate hotfix for an earlier bug. A store can be on the newest monthly release and still be missing an exploited fix. Track both, per store, with evidence.
Try it yourself
Pick one store and write down three facts with evidence: its exact release string, the date the CVE-2026-75650 hotfix was applied, and the list of enabled third party modules. If any of the three takes more than ten minutes to find, that is your process gap.
Click through it at your own pace, or open it full screen.
Quick check
Does installing the October 2026 Commerce release cover CVE-2026-75650?
No. The bulletin says to apply the hotfix for CVE-2026-75650 from APSB26-146 in addition to the October security updates.
Which APSB26-153 CVE has the highest score and does it need authentication?
CVE-2026-103849, a template engine injection rated CVSS 10.0. Adobe lists it as not requiring authentication.
What should Magento Open Source 2.4.6 users do?
The bulletin lists 2.4.6 as affected but gives no 2.4.6 fixed release for Open Source, so plan an upgrade to a supported line that has a 2026-oct release, such as 2.4.7 or later.
