Adobe Releases Another Magento Security Patch (APSB26-92) — Here’s What Changed and What You Need to Do

Adobe published yet another security bulletin yesterday — APSB26-92, dated August 11, 2026 — and it comes just four weeks after July’s APSB26-73 release. If you feel like these patches are arriving faster than ever, you’re not wrong. Adobe has shifted to a monthly security release cadence, and this August update is exactly why that matters. 

This one resolves 7 vulnerabilities across Adobe Commerce and Magento Open Source, with 5 rated Critical. The most severe carries a CVSS score of 9.1 — and it requires no authentication at all to exploit. 

There’s something else worth knowing upfront: the August patches ship as Isolated patch files only, not Composer packages. That changes how you apply them, and if you don’t know what that means, we’ll walk you through it clearly below. 

If your store is running an affected version of Adobe Commerce or Magento Open Source, this is your prompt to act today. 

What Is APSB26-92? 

<cite index=”10-1″>APSB26-92 is Adobe’s August 11, 2026 security update for Adobe Commerce and Magento Open Source. It resolves critical, important, and moderate vulnerabilities. Successful exploitation could result in security feature bypass, arbitrary code execution, and privilege escalation.</cite> 

<cite index=”10-1″>Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates</cite> — at the time of publishing. That matters, but it isn’t a reason to relax. The pattern of 2026 is clear: working exploit code for critical Magento vulnerabilities tends to surface within days to weeks of public disclosure. Acting before that window closes is the only reliable way to stay ahead. 

Who Is Affected? 

<cite index=”11-1″>The following products and versions are affected across Adobe Commerce on Cloud infrastructure, Adobe Commerce on-premises, and Magento Open Source:</cite> 

Notice the phrasing — “2026-jul and earlier.” This means stores that applied July’s APSB26-73 patch are still affected and need to apply the August patch on top. These patches are cumulative in sequence: <cite index=”11-1″>each monthly Isolated patch builds on the ones released before it and must be applied cumulatively, in release order.</cite> 

Which Patched Versions Are Available? 

Adobe has assigned a Priority Rating of 2 to this release — meaning it should be applied within 30 days at most. Given the severity of the unauthenticated vulnerabilities in this bulletin, we’d encourage applying it significantly sooner than that. 

The 7 Vulnerabilities — What They Actually Mean for Your Store 

🔴 CRITICAL: Incorrect Authorization — CVE-2026-71362 (CVSS 9.1) — No Authentication Required 

This is the headline vulnerability in APSB26-92, and it’s the one that should concern you most. 

An incorrect authorization vulnerability means the application fails to properly check whether someone has permission to do what they’re attempting. CVE-2026-71362 takes this a step further — it requires no authentication at all. Any anonymous person on the internet can attempt to exploit it against a store running an affected version. 

The impact is privilege escalation. In practical terms, an unauthenticated attacker can gain access to parts of your store — data, functionality, or administrative capabilities — that should be completely off-limits without credentials. 

Why a CVSS 9.1 unauthenticated flaw is serious: This sits in the same severity range as PolyShell (APSB25-94, CVSS 9.1), which went from public disclosure to mass automated exploitation targeting 79.5% of all monitored Magento stores in 72 hours. An unauthenticated, remotely exploitable vulnerability of this type is exactly what attackers build automated scanning and exploitation tooling for — because it works against every unpatched store without any prior access or reconnaissance.

🔴 CRITICAL: Stored Cross-Site Scripting — CVE-2026-48413 (CVSS 8.7) — Authenticated, No Admin Required 

Any authenticated user — including a regular customer account — can trigger this. 

Stored XSS means malicious JavaScript gets saved into your database and executes automatically every time the affected page is loaded. What makes CVE-2026-48413 particularly dangerous is that it does not require admin privileges — a standard authenticated user (like a logged-in customer) can inject the malicious script. 

What happens if exploited: A logged-in customer crafts a malicious input and submits it through a standard storefront interaction. That input gets stored. Every admin user who subsequently views the affected page — an order, a customer record, a product review — has the script execute silently in their browser. This is how admin sessions get hijacked without the admin ever knowing. Once an attacker has a hijacked admin session, they can operate with full admin privileges on your store: create accounts, modify orders, access customer data, and install persistent backdoors. 

Why this matters even when auth is required: Customer account registration on a Magento store is open to anyone. An attacker doesn’t need a special relationship with your store to create an account and exploit this vulnerability. The authentication barrier here is minimal. 

🔴 CRITICAL: Stored Cross-Site Scripting — CVE-2026-48414 (CVSS 7.7) — Admin Required 

Requires admin credentials, but leads to arbitrary code execution. 

A second stored XSS vulnerability, this one requiring admin-level access to trigger. The impact is arbitrary code execution — meaning a malicious or compromised admin user can inject code that gets executed in other users’ browser contexts, potentially enabling server-side exploitation depending on the attack chain. 

This vulnerability reinforces a point worth repeating: admin account security is not a separate issue from application security. A phished admin password, a credential reused from a breached third-party service, or a session hijacked through another vulnerability all create the conditions for this flaw to be exploited. Defense in depth matters. 

🔴 CRITICAL: Incorrect Authorization — CVE-2026-48415 (CVSS 7.6) — B2B Specific, Authenticated 

Adobe Commerce B2B merchants need to pay particular attention to this one. 

CVE-2026-48415 is flagged specifically for Adobe Commerce B2B deployments. It’s an authorization control failure that allows an authenticated (but non-admin) user to bypass security features they should not be able to circumvent — including, potentially, access controls that govern B2B-specific functionality like shared catalogs, company account structures, and custom pricing. 

What happens if exploited: An authenticated B2B buyer account bypasses authorization gates and accesses functionality or data beyond their permitted scope. Depending on what those gates protect — negotiated pricing for other accounts, restricted catalog sections, company admin functionality — the business impact can be significant. For B2B merchants where pricing, catalog access, and company hierarchies are central to the business model, this is not a theoretical concern. 

Important: The core APSB26-92 patch alone does not fix this. B2B merchants must apply both the core August patch and the corresponding Adobe Commerce B2B August security patch for complete remediation.

🔴 CRITICAL: Incorrect Authorization — CVE-2026-48416 (CVSS 7.5) — No Authentication Required 

A second unauthenticated vulnerability — this one focused on information exposure. 

Another incorrect authorization failure, again requiring no authentication to exploit. The impact here is security feature bypass with high confidentiality impact — sensitive data can potentially be read by anyone without logging in. 

What happens if exploited: An unauthenticated visitor can bypass authorization controls and access data that should be protected — potentially including customer information, order details, pricing data, or configuration details. Even without financial fraud occurring, an unauthorized disclosure of customer data carries GDPR and PCI DSS notification obligations for affected merchants. 

Two unauthenticated vulnerabilities in a single bulletin is unusual and reinforces why this patch should not sit in a backlog. 

🟠 IMPORTANT: Incorrect Authorization — CVE-2026-48411 (CVSS 6.8) — Admin Required 

Admin-level access required, but leads to significant authorization bypass. 

An additional incorrect authorization flaw, this one requiring admin credentials to trigger. The impact is security feature bypass with high integrity and availability impact — meaning an attacker with admin access (or a compromised admin account) can modify data or disrupt functionality beyond what their role should permit.

🟡 MODERATE: Incorrect Authorization — CVE-2026-48412 (CVSS 2.7) — Admin Required 

Lower severity, but still part of the same authorization control pattern. 

The lowest-severity vulnerability in this bulletin, requiring admin-level credentials with high attack complexity to exploit. The impact is limited write access to areas that should be restricted. While the isolated risk is low, it’s part of a broader pattern of authorization control failures addressed in APSB26-92 — and it’s fixed by the same patch.

Full Vulnerability Reference 

Two of the five Critical vulnerabilities require no authentication. That means two separate attack vectors exist on your store right now — available to any anonymous visitor on the internet — if you haven’t applied this patch. 

Something Different About This Release: Isolated Patches Only 

Most Adobe Commerce security updates ship as Composer packages, meaning you update via composer update in your standard workflow. This August release is different, and it’s important to understand why. 

<cite index=”11-1″>The security fixes released on August 11, 2026 for Adobe Commerce versions 2.4.9, 2.4.8, 2.4.6, 2.4.5, and 2.4.4 were classified as Isolated security fixes. For this type of release, Adobe provides the fixes as Isolated patch files only, and Composer packages are not published alongside them. This is intentional: Isolated patches are designed to give merchants a fast, lightweight way to apply critical security fixes without needing to go through a full Composer-based update cycle, which can take longer and may involve additional dependency resolution.</cite> 

In other words, Adobe released these as ZIP files rather than Composer packages specifically to make them faster to apply. That’s a signal about urgency, not a downgrade in quality. 

Important Prerequisites Before You Apply 

<cite index=”11-1″>Merchants must be on the latest security-only patch release for their supported release line before applying the Isolated patch, as Isolated security fixes are tested exclusively against that version. Merchants must have also applied all previous monthly Isolated security patches for their release line, because each monthly Isolated patch builds on the ones released before it and must be applied cumulatively, in release order.</cite> 

In plain terms: before applying the August patch, make sure the July APSB26-73 patch is already in place. If it isn’t, you need to apply July first, then August.

Patch Download Links (from Adobe’s Official Repository) 

Your Version	Download
2.4.9-2026-jul	2-4-9-aug-2026.zip
2.4.8-2026-jul	2-4-8-p5-aug-2026.zip
2.4.7-2026-jul	2-4-7-p10-aug-2026.zip
2.4.6-2026-jul	2-4-6-p15-aug-2026.zip
2.4.5-2026-jul	2-4-5-p17-aug-2026.zip (Composer key required)
2.4.4-2026-jul	2-4-4-p18-aug-2026.zip (Composer key required)

For versions 2.4.5 and 2.4.4, you’ll be prompted for your Composer public key as the username and your private key as the password when downloading. 

For Adobe Commerce Cloud Merchants 

<cite index=”11-1″>These security patches can also be applied directly through Magento Cloud Patches.</cite> Check the Cloud Patches Release Notes for the relevant update. Cloud merchants have a streamlined path that doesn’t require manually managing the Isolated patch file. 

Why You Should Not Wait on This Patch 

We know how it goes. A bulletin lands, it gets added to the queue, and a week becomes two weeks becomes a month. In 2024 and 2025, that approach was risky. In 2026, it has proven to be actively harmful. 

PolyShell (APSB25-94, CVSS 9.1) was mass-exploited in 72 hours. SessionReaper was exploited within days. APSB26-73 was published in July — and here we are in August with another bulletin already stacking on top of it. 

The pattern Adobe is signaling with monthly releases is not that there are more vulnerabilities than before. It’s that the security landscape moves fast enough that a quarterly cadence is no longer adequate. Monthly patches are a feature, not a burden. They mean critical fixes reach merchants faster. 

But they only help if merchants apply them. 

Here’s the risk picture for APSB26-92 specifically. Two of the Critical vulnerabilities require zero authentication. CVE-2026-71362 (CVSS 9.1) allows unauthenticated privilege escalation. CVE-2026-48416 (CVSS 7.5) allows unauthenticated security feature bypass with high confidentiality impact. These are not vulnerabilities an attacker needs special access to exploit. Any anonymous visitor can attempt them against an unpatched store. 

The cost of a breach — customer notification, forensic investigation, PCI DSS penalties, chargebacks from skimmed payment data, reputational damage — consistently exceeds the cost of a planned patch deployment. There is no version of the math where delaying makes sense. 

How to Apply the APSB26-92 Security Patch — Step by Step 

Step 1: Confirm You Are on the July Patch First 

Log into your admin panel, go to System → About Magento, and verify your version number ends in -2026-jul. If it doesn’t, apply the July APSB26-73 patch before proceeding. The August Isolated patch is built on top of July and will not install correctly without it. 

Step 2: Download the Correct Isolated Patch File 

Use the download links in the table above to download the ZIP file for your version from Adobe’s official repository at repo.magento.com. Use your Composer public and private keys if prompted. 

Step 3: Apply the Patch to Staging First 

Unzip the downloaded file. For each component installed in your environment — CE, EE, B2B, PageBuilder — apply the matching file for your installed version. Refer to Adobe’s guide on applying a Composer patch for the exact commands. 

Test your complete checkout flow, payment processing, customer account creation, and all custom integrations before moving to production. 

Step 4: Apply the B2B August Patch Separately 

If your installation includes Adobe Commerce B2B, apply the corresponding B2B August patch after the core patch. CVE-2026-48415 — the B2B-specific authorization bypass — is not resolved by the core patch alone. The B2B patch is mandatory for complete remediation on B2B deployments. 

Step 5: Deploy to Production 

Schedule production deployment during a low-traffic window. Apply the patch, run smoke tests across checkout, search, account creation, and B2B workflows if applicable. Monitor error logs for 24 hours post-deployment. 

Step 6: Verify with the Commerce Version Tool 

<cite index=”11-1″>Adobe has introduced a new Commerce Version Tool with these security updates. This standalone executable, included with each monthly Adobe Commerce security patch, helps merchants verify patch coverage by reporting which monthly security patches are installed, which are missing, and which CVEs the installation is protected against.</cite> Run it after applying the patch to confirm your installation is fully covered. 

Step 7: Post-Patch Verification Checklist 

• ✅Version number in admin confirms -2026-aug release 
• ✅Checkout and payment processing functioning correctly 
• ✅B2B workflows intact (if applicable)
• ✅Admin user list reviewed for any unrecognised accounts 
• ✅pub/media/ and pub/static/ scanned for unexpected PHP files 
• ✅WAF rules updated to cover APSB26-92 CVEs 
• ✅Commerce Version Tool run and confirming all patches applied

Are There Active Exploits Right Now? 

<cite index=”10-1″>Adobe is not aware of any exploits in the wild for any of the issues addressed in APSB26-92</cite> at the time of publication. Based on the trajectory of 2026 security incidents, that window is narrower than it used to be. For unauthenticated Critical vulnerabilities, the conservative assumption is that working exploit code will exist within days to weeks of disclosure. Acting within that window — not after it — is what keeps stores protected. 

Need Help Applying APSB26-92 Without Downtime? 

Applying an Isolated patch to a live Adobe Commerce or Magento Open Source store is more involved than a standard Composer update. You need to verify prerequisites, handle multiple component files correctly (CE, EE, B2B, PageBuilder), test against your custom modules, and deploy carefully to avoid downtime — especially if you’re running Adobe Commerce B2B or Cloud infrastructure. 

Our Magento security specialists can review your store, confirm your July patch status, apply all required APSB26-92 Isolated patch files for your environment, verify custom modules and integrations remain intact, and ensure your checkout operates without disruption throughout. 

Most APSB26-92 patch deployments are completed within 24 to 48 hours.

👉 Contact Aims Infosoft for APSB26-92 Patch Assistance → 

References & Further Reading 

• Adobe Security Bulletin APSB26-92 — https://helpx.adobe.com/security/products/magento/apsb26-92.html List Item 1
• Adobe Experience League — APSB26-92 Release Notes (KA-40380) — https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-40380 
• Adobe Commerce Patch Release Schedule — https://experienceleague.adobe.com/en/docs/commerce-operations/release/planning/schedule 
• How to Apply a Composer Patch from Adobe — https://experienceleague.adobe.com/en/docs/commerce-knowledge-base/kb/how-to/how-to-apply-a-composer-patch-provided-by-magento 
• Cloud Patches Release Notes — https://experienceleague.adobe.com/en/docs/commerce-on-cloud/user-guide/release-notes/cloud-patches#latest 
• CVE-2026-71362 — Incorrect Authorization, Unauthenticated (CVSS 9.1) 
• CVE-2026-48413 — Stored XSS (CVSS 8.7) 
• CVE-2026-48415 — Incorrect Authorization, B2B (CVSS 7.6) 
• CVE-2026-48416 — Incorrect Authorization, Unauthenticated (CVSS 7.5)