APSB26-92 - APSB26-92: Security update available for Adobe Commerce Security Update

Bulletin Information

• Bulletin ID: APSB26-92
• Product: APSB26-92: Security update available for Adobe Commerce
• Published: August 11, 2026
• Priority: 2
• Severity: Critical
• CVE Count: 7

Affected Versions

• Adobe Commerce: 2.4.9-2026-jul and earlier2.4.8-2026-jul and earlier2.4.7-2026-jul and earlier2.4.6-2026-jul and earlier2.4.5-2026-jul and earlier2.4.4-2026-jul and earlier
• Adobe Commerce B2B: 1.5.3-2026-jul and earlier1.5.2-2026-jul and earlier1.4.2-2026-jul and earlier1.3.4-2026-jul and earlier1.3.3-2026-jul and earlier
• Magento Open Source: 2.4.9-2026-jul and earlier2.4.8-2026-jul and earlier2.4.7-2026-jul and earlier2.4.6-2026-jul and earlier

Vulnerability Details

Total Vulnerabilities: 7

Severity Breakdown:

• Moderate: 1
• Important: 1
• Critical: 5

Key Vulnerabilities:

1. CVE-2026-71362

• Category: Incorrect Authorization (CWE-863)
• Impact: Privilege escalation
• Severity: Critical
• CVSS Score: 9.1
• Authentication Required: No

2. CVE-2026-48414

• Category: Cross-site Scripting (Stored XSS) (CWE-79)
• Impact: Arbitrary code execution
• Severity: Critical
• CVSS Score: 7.7
• Authentication Required: Yes

3. CVE-2026-48413

• Category: Cross-site Scripting (Stored XSS) (CWE-79)
• Impact: Arbitrary code execution
• Severity: Critical
• CVSS Score: 8.7
• Authentication Required: Yes

…and 4 more vulnerabilities

CVE Identifiers

CVE-2026-48413, CVE-2026-48411, CVE-2026-48416, CVE-2026-48415, CVE-2026-48412, CVE-2026-71362, CVE-2026-48414

Read Full Bulletin on Adobe Security Portal →