Magento APSB26-92: Security Update and Risks
· 3 min read
On August 11, 2026 Adobe published security bulletin APSB26-92, which fixes seven vulnerabilities in Magento Open Source and Adobe Commerce, five of them rated critical. The most serious lets an attacker take over a customer's account without knowing the password. At release Adobe reported no attacks in progress, but the window to update calmly is short: if you run a Magento store, plan the update now.
Informative article, not a security assessment: the right actions depend on your store's setup.
What your store is risking
The fixed flaws can allow security controls to be bypassed, unauthorized code to run, or permissions to be obtained that should not be available. For an online store this means:
- Compromised customer accounts: an attacker can see other people's personal data and orders, with possible data-protection consequences.
- Unauthorized system access: settings changed or malicious code inserted into the site.
- Sales and reputation: an incident can lead to your payment system being blocked and to customers losing trust.
Why not wait
When Adobe publishes a bulletin, the flaws become public knowledge and attackers study the fixes to target stores that have not updated. Adobe gives this update priority 2 (no known attacks at release time), but security researchers report exploitation attempts against the main flaw. The sooner you update, the less time attackers have.
Which stores are affected
According to Adobe's bulletin, installations not updated to the August 2026 version are affected:
- Magento Open Source from 2.4.6 to 2.4.9;
- Adobe Commerce (including Cloud) from 2.4.4 to 2.4.9;
- Adobe Commerce B2B, with the corresponding versions.
To check your exact version, consult the official bulletin or ask whoever manages your store.
Action plan
A rushed update can clash with your design and payment modules. These are the recommended steps:
| Step | Action | Why it matters |
|---|---|---|
| 1. Prerequisites | Check that earlier updates (such as July 2026) are installed. | The fix needs an up-to-date base, otherwise it fails. |
| 2. Test | Apply the update to a copy of the site. | You find incompatibilities before a customer does. |
| 3. Check | Verify cart, payment, sign-up and email sending. | Sales continue without surprises. |
| 4. Go live | Deploy during low-traffic hours. | Minimal disruption for customers. |
| 5. Review | Look for unusual accounts and admin access. | You spot any abuse that happened before the update. |
Frequently asked questions
Do we need to update even if there are no known attacks?
Yes. Once published, the flaws are known to everyone and exploited quickly. Updating in the days after release is the prudent choice.
Can the update change the design or features of the site?
Normally not: it only fixes the flaws. If you have customizations in the affected areas, a test beforehand is needed.
What if we skipped earlier updates?
The latest fixes require the previous ones. With a backlog, an ordered sequence is needed to avoid errors.
Security updates without worry
Updating Magento or Adobe Commerce on your own can cause outages and incompatibilities. With the maintenance and support service, security bulletins are applied promptly, after testing, without compromising customizations, speed or sales.
Want to know if your store is up to date? Request a security audit and a free quote.
Is your store no longer receiving updates? See replatforming and migrations.