adobe-commerce on Adobe Digest

APSB25-94 - APSB25-94: Security update available for Adobe Commerce Security Update

Tue, 14 Oct 2025 01:00:00 -0400

Bulletin Information

Bulletin ID: APSB25-94
Product: APSB25-94: Security update available for Adobe Commerce
Published: October 14, 2025
Priority: 2
Severity: Critical
CVE Count: 5

Affected Versions

Adobe Commerce: 2.4.9-alpha2 and earlier2.4.8-p2 and earlier2.4.7-p7 and earlier2.4.6-p12 and earlier2.4.5-p14 and earlier2.4.4-p15 and earlier
Adobe Commerce B2B: 1.5.3-alpha2 and earlier1.5.2-p2 and earlier1.4.2-p7 and earlier1.3.5-p12 and earlier1.3.4-p14 and earlier1.3.3-p15 and earlier
Magento Open Source: 2.4.9-alpha22.4.8-p2 and earlier2.4.7-p7 and earlier2.4.6-p12 and earlier

Vulnerability Details

Total Vulnerabilities: 5

Severity Breakdown:

Important: 3
Critical: 2

Key Vulnerabilities:

1. CVE-2025-54263

Category: Incorrect Authorization (CWE-863)
Impact: Security feature bypass
Severity: Critical
CVSS Score: 8.1
Authentication Required: Yes

2. CVE-2025-54264

Category: Cross-site Scripting (Stored XSS) (CWE-79)
Impact: Privilege escalation
Severity: Critical
CVSS Score: 8.1
Authentication Required: Yes

3. CVE-2025-54265

Category: Incorrect Authorization (CWE-863)
Impact: Security feature bypass
Severity: Important
CVSS Score: 5.9
Authentication Required: No

…and 2 more vulnerabilities

CVE Identifiers

CVE-2025-54266, CVE-2025-54267, CVE-2025-54263, CVE-2025-54264, CVE-2025-54265

Read Full Bulletin on Adobe Security Portal →

APSB25-88 - APSB25-88: Security update available for Adobe Commerce Security Update

Tue, 09 Sep 2025 01:00:00 -0400

Bulletin Information

Bulletin ID: APSB25-88
Product: APSB25-88: Security update available for Adobe Commerce
Published: September 09, 2025
Priority: 1
Severity: Critical
CVE Count: 1

Affected Versions

Adobe Commerce: 2.4.9-alpha2 and earlier2.4.8-p2 and earlier2.4.7-p7 and earlier2.4.6-p12 and earlier2.4.5-p14 and earlier2.4.4-p15 and earlier
Adobe Commerce B2B: 1.5.3-alpha2 and earlier1.5.2-p2 and earlier1.4.2-p7 and earlier1.3.4-p14 and earlier1.3.3-p15 and earlier
Magento Open Source: 2.4.9-alpha2 and earlier2.4.8-p2 and earlier2.4.7-p7 and earlier2.4.6-p12 and earlier2.4.5-p14 and earlier

Vulnerability Details

Total Vulnerabilities: 1

Severity Breakdown:

Critical: 1

Key Vulnerabilities:

1. CVE-2025-54236

Category: Improper Input Validation (CWE-20)
Impact: Security feature bypass
Severity: Critical
CVSS Score: 9.1
Authentication Required: No

CVE Identifiers

CVE-2025-54236

Read Full Bulletin on Adobe Security Portal →

APSB25-71 - APSB25-71: Security update available for Adobe Commerce Security Update

Tue, 12 Aug 2025 01:00:00 -0400

Bulletin Information

Bulletin ID: APSB25-71
Product: APSB25-71: Security update available for Adobe Commerce
Published: August 12, 2025
Priority: 2
Severity: Critical
CVE Count: 6

Affected Versions

Adobe Commerce: 2.4.9-alpha12.4.8-p1 and earlier2.4.7-p6 and earlier2.4.6-p11 and earlier2.4.5-p13 and earlier2.4.4-p14 and earlier
Adobe Commerce B2B: 1.5.3-alpha11.5.2-p1 and earlier1.4.2-p6 and earlier1.3.5-p11 and earlier1.3.4-p13 and earlier1.3.3-p14 and earlier
Magento Open Source: 2.4.9-alpha12.4.8-p1 and earlier2.4.7-p6 and earlier2.4.6-p11 and earlier2.4.5-p13 and earlier

Vulnerability Details

Total Vulnerabilities: 6

Severity Breakdown:

Important: 2
Critical: 4

Key Vulnerabilities:

1. CVE-2025-49554

Category: Improper Input Validation (CWE-20)
Impact: Application denial-of-service
Severity: Critical
CVSS Score: 7.5
Authentication Required: No

2. CVE-2025-49555

Category: Cross-Site Request Forgery (CSRF) (CWE-352)
Impact: Privilege escalation
Severity: Critical
CVSS Score: 8.1
Authentication Required: Yes

3. CVE-2025-49556

Category: Incorrect Authorization (CWE-863)
Impact: Arbitrary file system read
Severity: Critical
CVSS Score: 7.5
Authentication Required: Yes

…and 3 more vulnerabilities

CVE Identifiers

CVE-2025-49558, CVE-2025-49554, CVE-2025-49559, CVE-2025-49555, CVE-2025-49556, CVE-2025-49557

Read Full Bulletin on Adobe Security Portal →

APSB25-50 - APSB25-50: Security update available for Adobe Commerce Security Update

Tue, 10 Jun 2025 01:00:00 -0400

Bulletin Information

Bulletin ID: APSB25-50
Product: APSB25-50: Security update available for Adobe Commerce
Published: June 10, 2025
Priority: 1
Severity: Critical
CVE Count: 7

Affected Versions

Adobe Commerce: 2.4.82.4.7-p5 and earlier2.4.6-p10 and earlier2.4.5-p12 and earlier2.4.4-p13 and earlier
Adobe Commerce B2B: 1.5.2 and earlier1.4.2-p5 and earlier1.3.5-p10 and earlier1.3.4-p12 and earlier1.3.3-p13 and earlier
Magento Open Source: 2.4.82.4.7-p5 and earlier2.4.6-p10 and earlier2.4.5-p12 and earlier

Vulnerability Details

Total Vulnerabilities: 7

Severity Breakdown:

Moderate: 1
Important: 4
Critical: 2

Key Vulnerabilities:

1. CVE-2025-47110

Category: Cross-site Scripting (Reflected XSS) (CWE-79)
Impact: Arbitrary code execution
Severity: Critical
CVSS Score: 9.1
Authentication Required: Yes

2. CVE-2025-43585

Category: Improper Authorization (CWE-285)
Impact: Security feature bypass
Severity: Critical
CVSS Score: 8.2
Authentication Required: Yes

3. CVE-2025-27206

Category: Improper Access Control (CWE-284)
Impact: Security feature bypass
Severity: Important
CVSS Score: 5.3
Authentication Required: Yes

…and 4 more vulnerabilities

CVE Identifiers

CVE-2025-43585, CVE-2025-49550, CVE-2025-27207, CVE-2025-49549, CVE-2025-43586, CVE-2025-47110, CVE-2025-27206

Read Full Bulletin on Adobe Security Portal →

APSB25-26 - APSB25-26: Security update available for Adobe Commerce Security Update

Tue, 08 Apr 2025 01:00:00 -0400

Bulletin Information

Bulletin ID: APSB25-26
Product: APSB25-26: Security update available for Adobe Commerce
Published: April 08, 2025
Priority: 2
Severity: Important
CVE Count: 5

Affected Versions

Adobe Commerce: 2.4.8-beta22.4.7-p4 and earlier2.4.6-p9 and earlier2.4.5-p11 and earlier2.4.4-p12 and earlier
Adobe Commerce B2B: 1.5.1 and earlier1.4.2-p4 and earlier1.3.5-p9 and earlier1.3.4-p11 and earlier1.3.3-p12 and earlier
Magento Open Source: 2.4.8-beta22.4.7-p4 and earlier2.4.6-p9 and earlier2.4.5-p11 and earlier2.4.4-p12 and earlier

Vulnerability Details

Total Vulnerabilities: 5

Severity Breakdown:

Moderate: 1
Important: 4

Key Vulnerabilities:

1. CVE-2025-27188

Category: Improper Authorization (CWE-285)
Impact: Privilege escalation
Severity: Important
CVSS Score: 4.3
Authentication Required: Yes

2. CVE-2025-27189

Category: Cross-Site Request Forgery (CSRF) (CWE-352)
Impact: Application denial-of-service
Severity: Important
CVSS Score: 4.3
Authentication Required: Yes

3. CVE-2025-27190

Category: Improper Access Control (CWE-284)
Impact: Security feature bypass
Severity: Important
CVSS Score: 5.3
Authentication Required: Yes

…and 2 more vulnerabilities

CVE Identifiers

CVE-2025-27189, CVE-2025-27191, CVE-2025-27188, CVE-2025-27190, CVE-2025-27192

Read Full Bulletin on Adobe Security Portal →

APSB25-08 - Adobe-Commerce Security Update

Tue, 11 Feb 2025 01:00:00 -0400

Bulletin Information

Bulletin ID: APSB25-08
Published: February 11, 2025
Priority: 1
Severity: Critical
CVE Count: 31

Affected Versions

Adobe Commerce: 2.4.8-beta12.4.7-p3 and earlier2.4.6-p8 and earlier2.4.5-p10 and earlier2.4.4-p11 and earlier
Adobe Commerce B2B: 1.5.0 and earlier1.4.2-p3 and earlier1.3.5-p8 and earlier1.3.4-p10 and earlier1.3.3-p11 and earlier
Magento Open Source: 2.4.8-beta12.4.7-p3 and earlier2.4.6-p8 and earlier2.4.5-p10 and earlier2.4.4-p11 and earlier

Vulnerability Details

Total Vulnerabilities: 31

Severity Breakdown:

Moderate: 3
Important: 14
Critical: 14

Key Vulnerabilities:

1. CVE-2025-24406

Category: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) (CWE-22)
Impact: Privilege escalation
Severity: Critical
CVSS Score: 7.5
Authentication Required: No

2. CVE-2025-24407

Category: Incorrect Authorization (CWE-863)
Impact: Security feature bypass
Severity: Critical
CVSS Score: 7.1
Authentication Required: Yes

3. CVE-2025-24408

Category: Information Exposure (CWE-200)
Impact: Privilege escalation
Severity: Critical
CVSS Score: 8.1
Authentication Required: Yes

…and 28 more vulnerabilities

CVE Identifiers

CVE-2025-24418, CVE-2025-24407, CVE-2025-24429, CVE-2025-24421, CVE-2025-24434, CVE-2025-24419, CVE-2025-24427, CVE-2025-24435, CVE-2025-24426, CVE-2025-24428, CVE-2025-24425, CVE-2025-24415, CVE-2025-24412, CVE-2025-24423, CVE-2025-24413, CVE-2025-24438, CVE-2025-24409, CVE-2025-24437, CVE-2025-24406, CVE-2025-24411, CVE-2025-24414, CVE-2025-24416, CVE-2025-24422, CVE-2025-24432, CVE-2025-24436, CVE-2025-24410, CVE-2025-24408, CVE-2025-24417, CVE-2025-24420, CVE-2025-24430, CVE-2025-24424

Read Full Bulletin on Adobe Security Portal →

APSB24-40 - Adobe-Commerce Security Update

Tue, 11 Jun 2024 01:00:00 -0400

Bulletin Information

Bulletin ID: APSB24-40
Published: June 11, 2024
Priority: 1
Severity: Critical
CVE Count: 10

Affected Versions

Adobe Commerce: 2.4.7 and earlier2.4.6-p5 and earlier2.4.5-p7 and earlier2.4.4-p8 and earlier2.4.3-ext-7 and earlier2.4.2-ext-7 and earlier
Magento Open Source: 2.4.7 and earlier2.4.6-p5 and earlier2.4.5-p7 and earlier2.4.4-p8 and earlier
Adobe Commerce Webhooks Plugin: 1.2.0 to 1.4.0

Vulnerability Details

Total Vulnerabilities: 10

Severity Breakdown:

Important: 3
Critical: 7

Key Vulnerabilities:

1. CVE-2024-34111

Category: Server-Side Request Forgery (SSRF) (CWE-918)
Impact: Arbitrary code execution
Severity: Critical
CVSS Score: 8.5
Authentication Required: Yes

2. CVE-2024-34102

Category: Improper Restriction of XML External Entity Reference (‘XXE’) (CWE-611)
Impact: Arbitrary code execution
Severity: Critical
CVSS Score: 9.8
Authentication Required: No

3. CVE-2024-34103

Category: Improper Authentication (CWE-287)
Impact: Privilege escalation
Severity: Critical
CVSS Score: 8.1
Authentication Required: No

…and 7 more vulnerabilities

CVE Identifiers

CVE-2024-34103, CVE-2024-34108, CVE-2024-34105, CVE-2024-34110, CVE-2024-34107, CVE-2024-34104, CVE-2024-34111, CVE-2024-34106, CVE-2024-34109, CVE-2024-34102

Read Full Bulletin on Adobe Security Portal →

APSB24-18 - Adobe-Commerce Security Update

Tue, 09 Apr 2024 01:00:00 -0400

Bulletin Information

Bulletin ID: APSB24-18
Published: April 09, 2024
Priority: 3
Severity: Critical
CVE Count: 2

Affected Versions

Adobe Commerce: 2.4.7-beta3 and earlier2.4.6-p4 and earlier2.4.5-p6 and earlier2.4.4-p7 and earlier2.4.3-ext-6 and earlier2.4.2-ext-6 and earlier
Magento Open Source: 2.4.7-beta3 and earlier2.4.6-p4 and earlier2.4.5-p6 and earlier2.4.4-p7 and earlier

Vulnerability Details

Total Vulnerabilities: 2

Severity Breakdown:

Critical: 2

Key Vulnerabilities:

1. CVE-2024-20758

Category: Improper Input Validation (CWE-20)
Impact: Arbitrary code execution
Severity: Critical
CVSS Score: 9
Authentication Required: No

2. CVE-2024-20759

Category: Cross-site Scripting (Stored XSS) (CWE-79)
Impact: Arbitrary code execution
Severity: Critical
CVSS Score: 8.1
Authentication Required: Yes

CVE Identifiers

CVE-2024-20759, CVE-2024-20758

Read Full Bulletin on Adobe Security Portal →

APSB24-03 - Adobe-Commerce Security Update

Tue, 13 Feb 2024 01:00:00 -0400

Bulletin Information

Bulletin ID: APSB24-03
Published: February 13, 2024
Priority: 3
Severity: Critical
CVE Count: 5

Affected Versions

Adobe Commerce: 2.4.6-p3 and earlier2.4.5-p5 and earlier2.4.4-p6 and earlier2.4.3-ext-5 and earlier2.4.2-ext-5 and earlier
Magento Open Source: 2.4.6-p3 and earlier2.4.5-p5 and earlier2.4.4-p6 and earlier

Vulnerability Details

Total Vulnerabilities: 5

Severity Breakdown:

Moderate: 1
Important: 2
Critical: 2

Key Vulnerabilities:

1. CVE-2024-20719

Category: Cross-site Scripting (Stored XSS) (CWE-79)
Impact: Arbitrary code execution
Severity: Critical
CVSS Score: 9.1
Authentication Required: Yes

2. CVE-2024-20720

Category: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) (CWE-78)
Impact: Arbitrary code execution
Severity: Critical
CVSS Score: 9.1
Authentication Required: Yes

3. CVE-2024-20716

Category: Uncontrolled Resource Consumption (CWE-400)
Impact: Application denial-of-service
Severity: Important
CVSS Score: 5.7
Authentication Required: Yes

…and 2 more vulnerabilities

CVE Identifiers

CVE-2024-20720, CVE-2024-20719, CVE-2024-20716, CVE-2024-20718, CVE-2024-20717

Read Full Bulletin on Adobe Security Portal →

APSB23-50 - Adobe-Commerce Security Update

Tue, 10 Oct 2023 01:00:00 -0400

Bulletin Information

Bulletin ID: APSB23-50
Published: October 10, 2023
Priority: 3
Severity: Critical
CVE Count: 9

Affected Versions

Adobe Commerce: 2.4.7-beta1 and earlier2.4.6-p2 and earlier2.4.5-p4 and earlier2.4.4-p5 and earlier2.4.3-ext-4 and earlier2.4.2-ext-4 and earlier2.4.1-ext-4 and earlier2.4.0-ext-4 and earlier2.3.7-p4-ext-4 and earlier*
Magento Open Source: 2.4.7-beta1 and earlier2.4.6-p2 and earlier2.4.5-p4 and earlier2.4.4-p5 and earlier

Vulnerability Details

Total Vulnerabilities: 9

Severity Breakdown:

Important: 2
Critical: 7

Key Vulnerabilities:

1. CVE-2023-38218

Category: Improper Input Validation (CWE-20)
Impact: Privilege escalation
Severity: Critical
CVSS Score: 8.8
Authentication Required: No

2. CVE-2023-38219

Category: Cross-site Scripting (Stored XSS) (CWE-79)
Impact: Privilege escalation
Severity: Critical
CVSS Score: 8.4
Authentication Required: Yes

3. CVE-2023-38220

Category: Improper Authorization (CWE-285)
Impact: Security feature bypass
Severity: Critical
CVSS Score: 7.5
Authentication Required: Yes

…and 6 more vulnerabilities

CVE Identifiers

CVE-2023-38251, CVE-2023-38219, CVE-2023-38250, CVE-2023-38220, CVE-2023-26366, CVE-2023-26367, CVE-2023-38249, CVE-2023-38221, CVE-2023-38218

Read Full Bulletin on Adobe Security Portal →