Mage-OS 3.6.0: Security Update and What to Do
· 4 min read
On October 14, 2026 Mage-OS 3.6.0 was released, a security release: the community recommends upgrading every Mage-OS 3.x store. It includes Adobe's October 13 fix (APSB26-153), which resolves a critical vulnerability scoring 10 out of 10 that can be exploited without authentication to run code on the server. The upgrade is direct from 3.5.x, with no dependency or PHP version changes. But there is also a returns change to check.
What it fixes
The security fixes are those of Adobe's bulletin, ported into the Mage-OS version. In plain words:
- Running code on the server (CVE-2026-103849): an attack goes through the email template system and can take control of the store. It is the 10-out-of-10 flaw.
- Customer data exposure: with particular API searches, password hashes and reset codes could come out.
- Access to guest carts and bypassable checks in the admin content editor.
- Other fixes to template previews, email address validation and bulk product updates.
For the full list see the Mage-OS 3.6.0 release notes and the Adobe bulletin. The release also fixes seven non-security bugs, such as order PDFs and the customer export.
Watch the returns
The release also updates the returns module. The return period is now calculated from the shipping date, per quantity: expired products appear as not selectable and the labels use right-of-withdrawal terms, translated into Italian too.
There is one point to check before upgrading, though. The law starts the period at delivery, which the system does not know. That is why you should add your expected delivery time to the return days. If you leave the value as it is, you effectively extend every return window by however long shipping takes. For the legal picture read the withdrawal button in e-commerce.
What to do, in order
- Check your Mage-OS version. With this release, 3.5.0 is no longer supported.
- Plan the upgrade and test it in a test environment: from 3.5.x it is direct.
- Review the return days as explained above.
- After upgrading check cart, payments, orders and emails.
- Recheck September. For the StyleSmuggler vulnerability the patch alone was not enough: if you have not yet followed those instructions, reread StyleSmuggler: critical vulnerability and patch. For the October patch Adobe also recommends rotating the encryption keys and related credentials: discuss it with whoever looks after your store.
One update a month
| Mage-OS release | Date | Reason |
|---|---|---|
| 3.2.0 | July 14 | Adobe's July security patch |
| 3.3.0 | August 5 | Critical flaw in the template import module |
| 3.4.0 | August 11 | Adobe security patch APSB26-92 |
| 3.5.0 | September 8 | StyleSmuggler emergency fix |
| 3.6.0 | October 14 | Adobe security patch APSB26-153 |
Frequently asked questions
My store is on Magento Open Source, not Mage-OS: does this concern me?
This release is for Mage-OS. For Adobe Commerce and Magento Open Source, Adobe's October patch applies, explained in this article.
How complicated is the upgrade?
From 3.5.x it is a direct upgrade, with no dependency changes. It should still be tested and handled by someone who knows your store, because it also touches returns and emails.
What happens if I stay on 3.5.0?
With this release 3.5.0 reaches end of support: it will receive no further fixes and stays exposed to the October issues.
Security updates without the worry
Following a release a month, testing it and deploying it without stopping sales is recurring work. With the maintenance and support service I take care of it, on Mage-OS, Magento and Adobe Commerce.
Want to know whether your store is up to date? Request a security audit and a free quote.
Considering a move to Mage-OS? See replatforming and migrations and Mage-OS Hackathon Italy: a distribution for companies.
Informative article: the data comes from the Mage-OS 3.6.0 release notes of October 14, 2026 and Adobe's bulletin APSB26-153. For upgrade instructions always refer to the official documentation.