Magento October Update Closes an Unauthenticated RCE

What Adobe Released

On October 13, 2026, Adobe published APSB26-153 for Adobe Commerce, Adobe Commerce B2B and Magento Open Source. It fixes eleven vulnerabilities, five of them critical, that could lead to arbitrary code execution, privilege escalation, writes to the file system and security feature bypass. Adobe says it is not aware of any exploits in the wild for these issues.

The Two That Need No Login

• CVE-2026-103849, CVSS 10.0. A template engine flaw (CWE-1336) that lets an attacker run code on the server without logging in and without anyone clicking anything. Its CVSS scope is marked as changed, so a successful attack can reach beyond the vulnerable component.
• CVE-2026-92909, CVSS 9.8. An authorization flaw in Adobe Commerce B2B that also leads to code execution without a login.

The other nine need a logged-in account or someone opening crafted content. Among them are stored cross-site scripting flaws, two rated critical at 9.3, which run in the browser of whoever views the injected content and lead to privilege escalation.

Which Version to Install

Adobe now puts the month in the name of each patch release. The fixed builds are these.

• Adobe Commerce 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct and 2.4.4-2026-oct
• Magento Open Source 2.4.9-2026-oct, 2.4.8-2026-oct and 2.4.7-2026-oct
• Adobe Commerce B2B 1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct and 1.3.3-2026-oct

The September releases, named -2026-sep, and everything older are affected. 2.4.10-alpha1, the first alpha of the next line, carries the fixes too, but it is an alpha meant for testing rather than for a live store.

Magento Open Source 2.4.6 Gets No Fix

Magento Open Source 2.4.6 is on the affected list but not on the fixed list, which starts at 2.4.7. A store on Open Source 2.4.6 has no patch for these flaws and needs an upgrade to 2.4.7 or newer. The licensed Adobe Commerce 2.4.6 does get 2.4.6-2026-oct.

How Fast to Patch

Adobe rates the update Priority 2. On its scale that means acting within 30 days, for flaws with a high likelihood of exploitation and no known active exploits. Treat 30 days as the ceiling rather than the plan. An unauthenticated flaw rated 10.0 is exactly the kind attackers study the patch for, so we would schedule this one within days.

Keep the September Hotfix

The bulletin repeats that the hotfix for CVE-2026-75650 from APSB26-146 has to be applied in addition to these updates. That flaw was exploited as a zero-day in September, and if its hotfix or the key rotation Adobe asked for is still on your list, do that first.

Before It Goes Live

1. Back up the database and the code, and apply the update to a staging copy first.
2. Run bin/magento setup:upgrade, recompile and deploy static content, then test checkout and the admin login.
3. Check your third-party extensions against the new release before it reaches production.

Where It Fits

Moving between minor versions is the bigger job for stores still on older lines, and our guide on how to upgrade Magento 2.4.8 to 2.4.9 covers what changes. Keeping Magento stores patched on a schedule is part of our security and compliance work.

Sources

• Adobe: Security update available for Adobe Commerce, APSB26-153
• Adobe: Security bulletin severity and priority ratings
• Adobe: Security update available for Adobe Commerce, APSB26-146