Adobe has released security updates for Adobe Commerce, Adobe Commerce B2B, and Magento Open Source to address multiple critical vulnerabilities.
One of the most serious issues is a high-impact privilege-escalation flaw, tracked as CVE-2026-71362, which can be exploited without authentication.
This vulnerability arises from incorrect authorization controls and has a CVSS base score of 9.1 out of 10. Adobe warns that successful exploitation could allow attackers to bypass security measures, execute arbitrary code, or elevate privileges within vulnerable e-commerce environments.
Critical Adobe Commerce Flaw
The most severe flaw affects Adobe Commerce installations running the July 2026 security-update builds and earlier, specifically versions 2.4.4 through 2.4.9.
The vulnerability has the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating that it is remotely exploitable, requires no attacker privileges or user interaction, and can significantly impact on confidentiality and integrity.
While availability is not directly affected, an attacker with elevated permissions could access sensitive store data, modify application settings, or establish a foothold for further compromise.
Adobe’s bulletin APSB26-92, released on August 11, 2026, also addresses several other critical issues, including authorization flaws and stored cross-site scripting (XSS) vulnerabilities.
One notable unauthenticated incorrect-authorization vulnerability, CVE-2026-48416, is rated 7.5 and can cause a security-feature bypass.
Although it is not as severe as CVE-2026-71362, its lack of authentication requirements makes it particularly concerning for internet-facing storefronts and administrative interfaces. Security researcher Wohlie reported this flaw.
Two stored XSS vulnerabilities, CVE-2026-48413 and CVE-2026-48414, can lead to arbitrary code execution under certain conditions. CVE-2026-48413 has a CVSS score of 8.7 and requires low-privilege authentication and user interaction.
At the same time, CVE-2026-48414 is rated 7.7 and additionally requires administrative privileges. Adobe has also patched CVE-2026-48415, a critical security-feature bypass issue affecting the Adobe Commerce B2B component, along with two lower-severity authorization flaws, CVE-2026-48411 and CVE-2026-48412.
Organizations are urged to upgrade immediately to the August 2026 builds. Adobe Commerce users should update to one of the following versions: 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, or 2.4.4-2026-aug, depending on their supported release branch.
Adobe Commerce B2B users should apply the corresponding packages from 1.3.3 to 1.5.3 for August 2026, while Magento Open Source users should update their supported deployments from 2.4.6 to 2.4.9.
Adobe has assigned the update a Priority 2 rating and stated that it is not aware of any exploitation of the vulnerabilities addressed by APSB26-92 in the wild.
However, due to the unauthenticated nature and low attack complexity of CVE-2026-71362, prompt patching is crucial. Administrators should also review privileged account activity, investigate unexpected configuration changes, validate extension integrity, and ensure that appropriate web application firewalls and access control policies protect exposed Commerce instances.
Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world
