Adobe Commerce APSB26-153: Critical October Patch
· 4 min read
On October 13, 2026 Adobe published security bulletin APSB26-153 for Adobe Commerce, the B2B module and Magento Open Source. It fixes 11 vulnerabilities: 5 rated critical, 5 high and 1 medium. Adobe says it is not aware of attacks already under way, but asks you to apply the updates as soon as possible: those who do not remain vulnerable, and Adobe will have limited means to help them. The official bulletin has all the details.
What was fixed
| Severity | How many | Possible effect |
|---|---|---|
| Critical | 5 | Running code on the server, privilege escalation |
| High | 5 | Running code, writing files on the server, bypassing security controls, privilege escalation |
| Medium | 1 | Bypassing security controls |
The most serious one (CVE-2026-103849) has the maximum score, 10 out of 10, and allows code to run on the server without being authenticated. Three other critical vulnerabilities do not require authentication either.
Which stores are affected
- Adobe Commerce from version 2.4.4 to 2.4.9, up to the September 2026 releases, both on cloud and on your own servers.
- Magento Open Source from 2.4.6 to 2.4.9. Fixes are distributed for 2.4.7 and later: anyone on an older version has no patch.
- B2B module in versions 1.3.3 to 1.5.3.
What to do, in order
- Check your version and hosting type. If you are on Adobe Commerce cloud, the fix arrives with Adobe's automatic updates: applying the patch by hand when it is already there can cause installation errors.
- Check the base. The monthly patches are tested only on the latest yearly security release of your version and must be applied in order: if you skipped one, apply that first.
- Apply the October patch, the right file for your version and for each installed component.
- Also apply the hotfix for CVE-2026-75650, September's critical vulnerability (bulletin APSB26-146), if you have not already: Adobe asks for both. We covered it in StyleSmuggler: critical vulnerability and patch.
- Rotate your encryption keys and the related credentials. Adobe strongly recommends it as part of the remediation.
- Verify the result with Adobe's tool, which shows which patches are missing and which vulnerabilities you are protected from. Test everything in a test environment and release in a low-traffic window.
Why not wait
Four of the critical vulnerabilities require no credentials. Once a bulletin is published, anyone who wants to attack a store knows what to look for. That is why it is not worth putting it off, even though Adobe does not report attacks in progress.
The next date is November 10: an optional release because of the holiday code freeze, as is December 8.
Frequently asked questions
Do I have to apply the patch right away?
Adobe recommends applying the updates as soon as possible. With critical vulnerabilities that need no authentication, putting it off raises the risk with no benefit.
I am on Adobe Commerce cloud: what changes?
The fix is in Adobe's cloud package update. Check the installed version first, because applying the manual patch when the fix is already there can make the installation fail.
My store is on an old version: what now?
For Magento Open Source, below 2.4.7 there are no fixes, and the bulletin does not include Adobe Commerce versions older than 2.4.4. In that case the way forward is to update or change platform.
Security updates without the worry
Reading bulletins, testing patches, rotating keys and verifying the result without stopping sales is recurring work. With the maintenance and support service I take care of it: fixes are read, tested and released at the right time.
Want to know whether your store is up to date? Request a security audit and a free quote.
If your store runs a version that no longer receives fixes, see replatforming and migrations.
Informative article: the data comes from bulletin APSB26-153 and Adobe's support article of October 13, 2026. For installation instructions always refer to the official documentation.