Magento Zero-Day and October 2026 Security Updates

Within five weeks, Adobe released three security updates for Adobe Commerce and Magento Open Source: an exploited zero-day (7 September), a scheduled September bulletin (8 September) and the October bulletin (13 October). If you run a store on these platforms, or manage the servers underneath, this is what the window contained — per the Adobe Security Bulletins (https://www.adobe.com/trust/security/bulletins-and-advisories.html) cited below.

7 September: APSB26-146, the exploited zero-day

Adobe published APSB26-146 (https://www.adobe.com/security/products/magento/apsb26-146.html) with priority 1. Behind it: CVE-2026-75650 — an unauthenticated remote code execution in the template-engine category (CWE-1336) with a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Adobe states the vulnerability was exploited in the wild; security researchers (Tenable) place first observed exploitation around 4 September, and CISA added the CVE to its Known Exploited Vulnerabilities catalog on 8 September.

Affected (August 2026 builds and earlier):

• Adobe Commerce 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug and earlier
• Adobe Commerce B2B 1.5.3-2026-aug and earlier (1.5.2, 1.4.2, 1.3.4, 1.3.3)
• Magento Open Source 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug and earlier

The fix is hotfix VULN-39341 — a composer patch from repo.magento.com, not a version bump — and Adobe documented a full credential-rotation procedure around it: maintenance mode, cron disabled, rotate the encryption key plus admin passwords, integration tokens, OAuth secrets, payment-gateway credentials, database/Fastly and SSH keys, then flush cache and redeploy. Since the hotfix arrived days after exploitation began, treat every internet-facing store as a likely-compromise case: CERTVU's advisory (Advisory 273) (https://cert.gov.vu/images/publications/2026/Advisory_273.pdf) lists concrete IOCs, including masqueraded processes (fc cache, chronyd) in unusual locations, web shells under pub/media/ and files containing x_trace_ under var/report/.

8 September: APSB26-138, the scheduled bulletin

One day later came the regular September update, APSB26-138 (https://www.adobe.com/trust/security/products/magento/apsb26-138.html) (priority 2). It resolves eight vulnerabilities — among them two stored-XSS privilege-escalation flaws with unauthenticated exploitability (CVE-2026-76200 and CVE-2026-76201, both CVSS 9.3), several incorrect-authorization issues (up to 8.7, several marked for Adobe Commerce B2B) and a path traversal (CVE-2026-77110, CVSS 7.6). Notably, the fixes ship as the September isolated patch — Adobe did not publish a new -pN release — and the bulletin itself reminds merchants to apply the APSB26-146 hotfix in addition.

13 October: APSB26-153, eleven CVEs on the October bulletin

The 13 October update, APSB26-153 (https://www.adobe.com/trust/security/products/commerce/apsb26-153.html) (priority 2), fixes eleven CVEs affecting Adobe Commerce, Adobe Commerce B2B and Magento Open Source at their September 2026 builds and earlier. Adobe notes it is not aware of any exploits in the wild for these issues. The lineup (from the official bulletin):

• CVE-2026-103849 — CVSS 3.1: 10.0 — Template engine (CWE-1336), arbitrary code execution — Authentication required to exploit: No
• CVE-2026-92909 — CVSS 3.1: 9.8 — Incorrect authorization (CWE-863), arbitrary code execution — Authentication required to exploit: No — Note: B2B
• CVE-2026-91013 — CVSS 3.1: 9.3 — Stored XSS, privilege escalation — Authentication required to exploit: No
• CVE-2026-100133 — CVSS 3.1: 9.3 — Stored XSS, privilege escalation — Authentication required to exploit: No
• CVE-2026-92464 — CVSS 3.1: 9.1 — Improper input validation, arbitrary code execution — Authentication required to exploit: Yes
• CVE-2026-92911 — CVSS 3.1: 8.7 — Stored XSS, arbitrary code execution — Authentication required to exploit: Yes
• CVE-2026-95631 — CVSS 3.1: 8.7 — Improper input validation, arbitrary file system write — Authentication required to exploit: Yes
• CVE-2026-92908 — CVSS 3.1: 8.3 — Incorrect authorization, security feature bypass — Authentication required to exploit: Yes — Note: B2B
• CVE-2026-92922 — CVSS 3.1: 8.1 — Stored XSS, privilege escalation — Authentication required to exploit: Yes
• CVE-2026-92910 — CVSS 3.1: 7.2 — Incorrect authorization, security feature bypass — Authentication required to exploit: No — Note: B2B
• CVE-2026-95630 — CVSS 3.1: 4.3 — Improper input validation, security feature bypass — Authentication required to exploit: Yes

Patched builds are the -2026-oct isolated-patch levels for each supported branch (e.g. 2.4.9-2026-oct through 2.4.4-2026-oct for Adobe Commerce, 1.5.3-2026-oct etc. for B2B, 2.4.9-2026-oct through 2.4.7-2026-oct for Magento Open Source); 2.4.10-alpha1 (https://www.adobe.com/trust/security/products/commerce/apsb26-153.html) is the first alpha of the next release line. Two things matter for your patch run: per Adobe's release notes, the hotfix for CVE-2026-75650 is still not included in the October isolated patch file (https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-49323) and must be applied separately; and CVE-2026-103849 sits in the same CWE-1336 template-engine category as the September zero-day, without authentication required.

What to do now

• Determine each store's deployed build level, then apply: the October bulletin build or the October isolated patch for APSB26-153; the VULN-39341 hotfix if it is not yet installed — per Adobe's KB, no strict installation order is required; and the September isolated patch if your line still lacks the APSB26-138 fixes.
• Verify the hotfix took effect — Adobe documents vendor/bin/magento-patches -n status | grep 39341 as the check.
• Treat the exposed window as a compromise investigation, not just a patching exercise: check the IOCs above, then run the documented credential-rotation sequence (encryption key, admin passwords, integration tokens, OAuth secrets, payment gateways, database/Fastly, SSH and deploy keys).
• Keep the server side tight: current backups taken before patching, application-log review for the IOCs above, and a tested rollback path if a patch step fails.

Final thoughts

For the application layer, your Magento developer is the right driver. But the events of these five weeks lived almost entirely on the server layer: composer patches that fail mid-run, credentials worth rotating, web shells to hunt, backups to restore in the worst case. That is where Linux-Server-Admin.com s.r.o. (https://linux-server-admin.com) works alongside store operators: we manage the Linux servers underneath, keep backups and monitoring current, watch file systems and logs for the indicators listed above, and give your Magento team an environment in which patching is a routine, not a fire drill.

Sources

• APSB26-146: https://www.adobe.com/security/products/magento/apsb26-146.html
• APSB26-138: https://www.adobe.com/trust/security/products/magento/apsb26-138.html
• APSB26-153: https://www.adobe.com/trust/security/products/commerce/apsb26-153.html
• Hotfix instructions (Adobe Commerce KB): https://experienceleague.adobe.com/en/docs/commerce-knowledge-base/kb/announcements/commerce-apsb26-146
• October release notes (KB): https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-49323
• Tenable FAQ on CVE-2026-75650: https://www.tenable.com/blog/stylesmuggler-cve-2026-75650-frequently-asked-questions-about-adobe-commerce-and-magento-zero
• CERTVU Advisory 273: https://cert.gov.vu/images/publications/2026/Advisory_273.pdf
• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-75650