In short
On 13 October 2026 Adobe released security update APSB26-153 for Adobe Commerce, Adobe Commerce B2B and Magento Open Source. It fixes 11 vulnerabilities, five of them critical, including one with the maximum CVSS score of 10.0 that needs no login. This month the fix comes only as isolated patch files, not as Composer packages, so a normal composer update will not install it.
Who is affected
Every store on Adobe Commerce 2.4.4 to 2.4.9, Adobe Commerce B2B 1.3.3 to 1.5.3 and Magento Open Source 2.4.6 to 2.4.9 that has not yet installed the October fixes. In Adobe’s version naming these are the “2026-sep and earlier” releases.
Adobe rates the update Priority 2 and says it is not aware of attacks using these vulnerabilities yet. Even so, a CVSS 10.0 issue that works without a login is exactly the kind of bug that gets exploited soon after details become public, so we recommend patching this week, not this month.
The 11 vulnerabilities at a glance
| CVE | Type | Severity | Login needed | CVSS |
|---|---|---|---|---|
| CVE-2026-103849 | Template engine injection, code execution | Critical | No | 10.0 |
| CVE-2026-92909 | Incorrect authorization, code execution (B2B) | Critical | No | 9.8 |
| CVE-2026-91013 | Stored XSS, privilege escalation | Critical | No | 9.3 |
| CVE-2026-100133 | Stored XSS, privilege escalation | Critical | No | 9.3 |
| CVE-2026-92464 | Improper input validation, code execution | Critical | Yes | 9.1 |
| CVE-2026-92911 | Stored XSS, code execution | High | Yes | 8.7 |
| CVE-2026-95631 | Improper input validation, file system write | High | Yes | 8.7 |
| CVE-2026-92908 | Incorrect authorization, security bypass (B2B) | High | Yes | 8.3 |
| CVE-2026-92922 | Stored XSS, privilege escalation | High | Yes | 8.1 |
| CVE-2026-92910 | Incorrect authorization, security bypass (B2B) | High | No | 7.2 |
| CVE-2026-95630 | Improper input validation, security bypass | Medium | Yes | 4.3 |
Why composer update is not enough this time
Adobe classified the October fixes as isolated security fixes. For this type of release Adobe publishes patch files only, one ZIP per version line, and no new Composer packages. The idea is speed: you apply a small patch instead of going through a full upgrade with dependency changes.
There are two conditions. Your store must already run the latest security release of its line, for example 2.4.7-p10 or 2.4.8-p5. And every earlier monthly isolated patch for that line must already be installed, because each month builds on the one before.
Which file you need
| Your version | Patch file |
|---|---|
| 2.4.9 | 2-4-9-oct-2026.zip |
| 2.4.8-p5 | 2-4-8-p5-oct-2026.zip |
| 2.4.7-p10 | 2-4-7-p10-oct-2026.zip |
| 2.4.6-p15 | 2-4-6-p15-oct-2026.zip |
| 2.4.5-p17 | 2-4-5-p17-oct-2026.zip |
| 2.4.4-p18 | 2-4-4-p18-oct-2026.zip |
Magento Open Source stores can download patches for 2.4.7 and later. Open Source 2.4.6 gets no October patch, so those stores need to upgrade to 2.4.7 or newer. Adobe Commerce stores on 2.4.6 or older log in with their Composer keys to download the file.
How to apply it, step by step
- Take a full backup of code and database, and put the patch on a staging copy first, never straight on the live store.
- Check your exact version and the components you have installed: CE, EE, B2B, PageBuilder and so on.
- Unzip the October file. It can contain several patch files, one per component and version. Use only the files that match the components and versions you actually run.
- Apply them in order: Community Edition (CE) first, then Enterprise Edition (EE), then B2B and the other components. If you missed an earlier month, apply that month first, in the same order.
- On Adobe Commerce on-premises and Magento Open Source, upload each patch to the Magento root folder and run the command below. If it fails, try -p2 instead of -p1.
patch -p1 < 249-2026-10-001-CE.patch
bin/magento cache:flushThe file name above is only an example of Adobe’s naming pattern: version, year, month, sequence number and component. Use the names that are actually inside your ZIP.
On Adobe Commerce on Cloud, copy the patch files into the m2-hotfixes folder in the project root, then commit and push. Cloud projects can also get the fix through the Magento Cloud Patches package. If your cloud-patches version already contains the fix, do not apply the isolated patch on top of it, because that makes the deployment fail.
Check that the store is really protected
Adobe’s Commerce Version Tool (CVT) shows which monthly patches are installed, which are missing, and for every CVE whether your store is PROTECTED, VULNERABLE or UNKNOWN. Run it from the Magento root folder:
php vendor/bin/patch-status --version
php vendor/bin/patch-statusIf the first command finds nothing, the tool is not installed yet. CVT ships with the July 2026 isolated patch, so install that one first, starting with its CE file.
Did you skip September?
Adobe asks every store to also install the hotfix for CVE-2026-75650 from bulletin APSB26-146 (7 September 2026). That vulnerability was actively exploited, and the hotfix is not part of the October patch. If you have not installed it yet, do it together with October.
Rotate keys and credentials
Adobe strongly recommends rotating the encryption key and the credentials connected to it as part of this update. A new key alone is not enough, because credentials that may have leaked stay valid until you change them at the source. Adobe’s order of work:
- Apply the patches, then switch on maintenance mode and stop cron.
- Rotate the Magento encryption key and change all admin passwords.
- Regenerate all REST, SOAP and GraphQL integration tokens and the OAuth secrets of connected apps.
- Change the API credentials of your payment provider in the provider’s own dashboard, for example Stripe, Adyen, PayPal or Braintree.
- Change database, SSH and deploy keys, and the API keys of shipping, tax and other integrations.
- Flush the cache, start cron again and switch off maintenance mode.
Our advice
Don’t wait for the next regular release. Patch staging today, test checkout, payment and the admin login, and go live this week. If CVT still reports VULNERABLE after patching, a monthly patch is missing or a file did not apply cleanly.
Stores on Magento Open Source 2.4.6, or on an older patch level like 2.4.7-p8, cannot use the October file directly. They need an upgrade first, and that is the moment to plan it properly instead of in a hurry.
Need help? MageBooster applies the October patch for you on staging first, checks it with CVT, rotates the keys and takes it live. Send us your Magento version and we reply the same business day.
Get help with the security update →
English
German
Dutch
Turkish