Adobe Commerce Security Patch APSB26-153: Why You Should Update Now

Adobe has released APSB26-153, a Priority 2 Adobe Commerce security patch published on October 13, 2026. It fixes 11 vulnerabilities across Adobe Commerce, Adobe Commerce B2B, and Magento Open Source, and five of them are rated critical. If your store runs on any of these products, this is an update to schedule this week, not next quarter. This guide explains what the bulletin says, why it matters, how to apply it safely, and how Viha Digital Commerce can help.

What the Bulletin Covers

This Magento security update addresses vulnerabilities that could result in arbitrary code execution, privilege escalation, arbitrary file system write, and security feature bypass. The key facts:

• Bulletin and date: APSB26-153, published on October 13, 2026.
• Priority: Adobe rates the update Priority 2.
• Severity mix: five critical, five high, and one medium vulnerability.
• Highest score: CVE-2026-103849 carries a CVSS score of 10.0 and can lead to arbitrary code execution.
• Exploits: Adobe says it is not aware of any exploits in the wild for these issues.

The Vulnerabilities at a Glance

The table below lists every issue in the bulletin, ordered by severity. The last column shows the issues that Adobe marks as affecting the B2B module.

What These Vulnerability Types Mean in Plain English

Security bulletins use technical terms, so here is what the four categories in APSB26-153 mean for a store owner:

• Template engine injection: input from a user is treated as part of a template, which can let an attacker run code on your server.
• Incorrect authorization: the system fails to check properly whether a user is allowed to perform an action, so restricted features can be reached.
• Stored cross-site scripting (XSS): a malicious script is saved in your store and runs in the browser of whoever views it, which can include an administrator.
• Improper input validation: the application accepts data it should have rejected, which can open the door to code execution or file changes.

Which Versions Are Affected

• Adobe Commerce: versions 2.4.4 through 2.4.9, up to and including the 2026-sep releases.
• Adobe Commerce B2B: versions 1.3.3, 1.3.4, 1.4.2, 1.5.2, and 1.5.3, up to and including the 2026-sep releases.
• Magento Open Source: versions 2.4.6 through 2.4.9, up to and including the 2026-sep releases.

The bulletin lists the platform as “All”, so the issues apply whether your store runs on-premises or elsewhere. If you are unsure which version you run, check it before doing anything else.

Why This Security Patch Is Crucial

Not every update carries the same weight. This one stands out for several reasons:

• Critical flaws that need no login: CVE-2026-103849, CVE-2026-92909, CVE-2026-91013, and CVE-2026-100133 are rated critical and do not require authentication to exploit. A fifth issue, CVE-2026-92910, is rated high and also needs no login.
• Stored cross-site scripting: several of the issues are stored XSS flaws that can result in privilege escalation.
• B2B exposure: three of the issues affect Adobe Commerce B2B, so merchants who sell to business buyers should pay close attention.
• Public fixes: once a bulletin is published, attackers can study what was fixed. Stores that wait are easier targets than stores that have already updated.
• An earlier fix still matters: Adobe notes that the hotfix for CVE-2026-75650, released with APSB26-146 on September 7, 2026, must be applied in addition to this update.

For an online store, the stakes are practical: customer data, order flow, checkout, and trust. A compromised store means downtime, cleanup costs, and damage to your brand. Updating promptly is far cheaper than recovering later.

What Happens If You Delay

Adobe states that it is not aware of exploits in the wild, and that is good news. It is also a snapshot of today. The risk with a delay is that the window between a public fix and a working attack can be short, and the stores most exposed are the ones still running the September releases. A delay also leaves your team juggling two problems at once: an unpatched store and a growing list of changes to test later. The longer you wait, the larger and riskier the update becomes.

What You Need to Install

Adobe recommends updating to the newest version for your product:

• Adobe Commerce: 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, or 2.4.4-2026-oct. A 2.4.10-alpha1 build is also listed.
• Adobe Commerce B2B: 1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, or 1.3.3-2026-oct. A 1.5.4-alpha1 build is also listed.
• Magento Open Source: 2.4.9-2026-oct, 2.4.8-2026-oct, or 2.4.7-2026-oct. A 2.4.10-alpha1 build is also listed.

Magento Open Source 2.4.6 appears in the affected list, but the updated versions listed for Open Source start at 2.4.7, so stores on 2.4.6 should plan an upgrade. The 2.4.10-alpha1 build is the first alpha of the next release line, so most live stores will want the 2026-oct release for their current version.

How to Apply the Update Safely

• Back up first: take a full backup of your files and database.
• Update staging first: apply the patch to a staging copy before touching production.
• Add the earlier hotfix: confirm the CVE-2026-75650 hotfix from APSB26-146 is installed as well.
• Test what matters: check checkout, payments, customer accounts, the admin, B2B flows, and every third-party extension.
• Deploy in a quiet window: release at low-traffic hours with a rollback plan ready.
• Monitor after go-live: watch logs, error rates, and unusual admin activity.

How Viha Digital Commerce Can Help

Viha Digital Commerce is an Adobe Commerce development agency, and we have already published guidance on earlier bulletins, including APSB26-146 and APSB26-73. For APSB26-153, our team can take the work off your hands:

• Version and exposure check: we confirm exactly which Adobe Commerce, B2B, or Open Source version you run and what is missing.
• Patching and upgrades: we apply the October update and the earlier hotfix, or plan a full upgrade where needed.
• Extension and custom code testing: we check that your modules and customizations still work after the update.
• Staging, QA, and release: we test on staging, run quality checks, and deploy with a rollback plan.
• Post-update monitoring: we keep watch after go-live so issues are caught early.

Frequently Asked Questions

Is my store affected?
If you run Adobe Commerce 2.4.4 to 2.4.9, Adobe Commerce B2B, or Magento Open Source 2.4.6 to 2.4.9 on a 2026-sep release or earlier, yes.

Adobe sees no exploits in the wild. Can I wait?
We recommend against it. Public fixes give attackers a roadmap, and five of the issues need no login.

Do I still need the APSB26-146 hotfix? 

Yes. Adobe asks merchants to apply the CVE-2026-75650 hotfix in addition to this update.

Should I move to 2.4.10-alpha1?
For most live stores, no. It is the first alpha of the next line, so the 2026-oct release for your current version is the safer choice.

Does this affect Shopify stores?
No. The bulletin covers Adobe Commerce, Adobe Commerce B2B, and Magento Open Source only.

Final Thoughts

APSB26-153 is a priority update for every Adobe Commerce and Magento Open Source store on an affected version. Adobe is not aware of exploits in the wild today, which makes now the best time to update, before that changes. Talk to Viha Digital Commerce about applying APSB26-153 to your store.