APSB26-153: Adobe Rated This Magento Patch “Priority 2.” It Fixes a CVSS 10.0 Flaw

By Aims Infosoft | #1 Magento Solutions Provider Published: October 17, 2026 | Security Advisory

“Priority 2” sounds manageable. Apply within 30 days, maybe. Fit it into the next sprint. It is not a fire drill.

Except one of the vulnerabilities it fixes carries a CVSS score of 10.0 — the highest possible rating in web application security. That score means an unauthenticated attacker, with no account and no credentials, can execute arbitrary code on your server. And this comes one month after StyleSmuggler — a different Magento zero-day that was actively exploiting stores while the community was still reading the advisory.

Adobe’s APSB26-153, released on October 13, 2026, fixes 11 vulnerabilities across Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. Five of them are Critical. Four of those five require no authentication to trigger. The Priority 2 rating reflects that no exploitation has been observed yet — it does not reflect the damage potential if that changes.

Here is what the patch covers, why the “no known exploits” framing needs context, and exactly how to apply it correctly.

What Is APSB26-153? (Quick Answer)

APSB26-153 is Adobe’s October 13, 2026 security bulletin for Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. It fixes 11 vulnerabilities, including CVE-2026-103849 — a CVSS 10.0 template-injection flaw (named BlockStrap by Sansec) that lets an unauthenticated attacker execute code on your server. Adobe rates it Priority 2, but every Magento store on an affected version should apply the October Isolated patch, the matching B2B patch, and the separate CVE-2026-75650 hotfix as soon as they are tested on staging.

• Released: October 13, 2026
• Affects: Adobe Commerce 2.4.4–2.4.9, Adobe Commerce B2B 1.3.3–1.5.3, and Magento Open Source 2.4.6–2.4.9 (September 2026 builds and earlier)
• Vulnerabilities fixed: 11 — 5 Critical, 5 High, 1 Medium
• Most severe flaw: CVE-2026-103849 — CVSS 10.0, no authentication required
• Adobe priority rating: Priority 2 (no exploitation observed at release)
• Patch format: Isolated patch files only — not Composer packages
• Also required: the B2B October patch (if B2B is installed) and the CVE-2026-75650 hotfix
• Adobe also recommends: rotating your encryption key and the credentials tied to it
• How to verify: run php vendor/bin/patch-status and confirm every CVE shows PROTECTED

What Does APSB26-153 Fix?

Eleven vulnerabilities. Five Critical, five High, one Medium. The potential impacts: arbitrary code execution, privilege escalation, arbitrary file system write, and security feature bypass.

Let’s go through the ones that matter most.

CVE-2026-103849 — CVSS 10.0 — No Authentication Required

A 10.0 is as bad as the scoring system allows. Completely unauthenticated — no customer account, no admin session, nothing. The flaw lives in how Magento’s template engine processes certain block directives. An attacker crafts a request that injects arbitrary PHP into the rendering path and executes it remotely.

This is the vulnerability Sansec named BlockStrap. Adobe’s October patch closes the vulnerable code path by replacing a generic rescan with registered placeholders. But that fix only reaches your store if you actually apply the patch. Right now, every production store running an affected version without October applied has a publicly disclosed CVSS 10.0 entry point sitting open.

CVE-2026-92909 — CVSS 9.8 — No Authentication Required — B2B

If you run Adobe Commerce B2B — shared catalogs, company accounts, negotiated pricing — this one is yours specifically. It is an incorrect authorization flaw in the B2B layer. An unauthenticated user can bypass authorization gates and trigger security feature bypass with critical impact.

One important note: the core APSB26-153 patch does not fix this by itself. You need to apply both the core October patch and the matching B2B October patch. This is the detail most merchants miss.

CVE-2026-91013 and CVE-2026-100133 — CVSS 9.3 each — Stored XSS — No Authentication Required

Two separate paths to the same outcome. Malicious JavaScript stored in your database, silently executing in admin and customer browser sessions with no visible sign. No warning. No error. The attacker plants the script once, and every subsequent page load for the affected user is compromised. Admin sessions get hijacked. Customer inputs at checkout get captured and forwarded.

Stored XSS without an authentication requirement is genuinely dangerous because the attack surface is every visitor to the affected page. On a live storefront, that can mean thousands of customers before anyone notices.

CVE-2026-92464 — CVSS 9.1 — Code Execution After Login (Critical)

Requires a logged-in account to trigger, which reduces the immediate exposure — but it is still rated Critical. But as 2026 has shown repeatedly — PolyShell, StyleSmuggler, the August bulletin — admin credentials get compromised through other means. A flaw that turns a compromised admin account into full code execution is not theoretical. It is the second step of an established attack chain.

The B2B Authorization Bypasses — CVE-2026-92908 and CVE-2026-92910

Two authorization failures in the B2B layer. One requires authentication. One does not. CVE-2026-92910 at CVSS 7.2 with no login required means any anonymous visitor can attempt to bypass B2B security controls. For merchants whose business model is built on controlled access to pricing, catalogs, and account permissions, that is a direct threat to how the store actually works.

APSB26-153 Vulnerability List: CVE, Severity and CVSS Scores

Eleven vulnerabilities in total. Four of the five Critical ones need no authentication — four separate, publicly disclosed entry points on your store until you apply this patch.

Is the CVE-2026-75650 Hotfix Included in APSB26-153? No — Apply It Separately

This is the detail most merchants miss, and it is important.

Adobe instructs merchants to apply a separate hotfix for CVE-2026-75650 alongside the October Isolated patch. That hotfix covers the vulnerability from the StyleSmuggler campaign in September. It is not included in the APSB26-153 patch files.

Applying the October patch alone does not cover CVE-2026-75650. You need both. The hotfix is documented separately in Adobe’s announcement for APSB26-146. Check your installation explicitly — do not assume that applying October means September is covered.

Is APSB26-153 Being Exploited? Why “No Known Exploits” Needs Context

Adobe’s Priority 2 rating comes with the standard note: no exploitation in the wild observed.

Consider what happened with APSB26-92, the August 11 Commerce bulletin. Also Priority 2. Also “not aware of any exploits in the wild.” CVE-2026-71362 from that bulletin was added to CISA’s Known Exploited Vulnerabilities catalogue 44 days later.

Forty-four days from “no known exploits” to confirmed active exploitation. And that was for a CVSS 9.1 flaw. This bulletin contains a CVSS 10.0.

Sansec reproduced four code-execution routes for CVE-2026-103849 on October 14 — one day after the patch dropped — and deployed Shield protection. The security research community has working exploit paths already. The question is not whether attackers will build tooling for a perfect-score, no-login vulnerability. It is when.

How Do You Apply APSB26-153 Correctly?

This patch ships as Isolated patch files only — not Composer packages. Adobe made it this way intentionally: Isolated patches apply faster, with less dependency resolution overhead. But the application order and prerequisites matter more than with a standard update.

Before You Start: Check Your Prerequisites

Merchants must be on the latest security-only patch release for their supported release line. More importantly — every prior monthly Isolated patch must already be applied, in release order. Each monthly Isolated patch builds on the one before it.

Concretely: September’s patches must be applied before October’s. July’s before September’s. If you have skipped a month, you cannot jump straight to October without working through the sequence.

Download the Right APSB26-153 Patch File for Your Magento Version

Download links:

• 2.4.9-2026-sep — 2-4-9-oct-2026.zip
• 2.4.8-p5 / 2026-sep — 2-4-8-p5-oct-2026.zip
• 2.4.7-p10 / 2026-sep — 2-4-7-p10-oct-2026.zip
• 2.4.6-p15 / 2026-sep — 2-4-6-p15-oct-2026.zip
• 2.4.5-p17 / 2026-sep — 2-4-5-p17-oct-2026.zip
• 2.4.4-p18 / 2026-sep — 2-4-4-p18-oct-2026.zip

For 2.4.6 and older, use your Composer public key as username and private key as password when the browser prompts on download.

Note for 2.4.8-p5 merchants: Adobe published a separate notice about an UNKNOWN patch status that can appear after applying the October patch. If you see that, refer to KA-50927 for the replacement guidance.

Apply in the Correct Component Order

Unzip the downloaded file. It contains multiple patch files — one per Adobe Commerce component (CE, EE, B2B, PageBuilder, and others). Apply them in this order:

1. CE (Community Edition) patch
2. EE (Enterprise Edition) patch — if you are on Adobe Commerce
3. B2B patch — if B2B is installed (required for CVE-2026-92909 and CVE-2026-92908)
4. Any remaining component patches (PageBuilder, etc.) present in the ZIP

A given month’s ZIP does not necessarily include a file for every component. Apply only the files present in that month’s ZIP for the components you actually have installed.

Always test on staging first. Confirm checkout, payment, B2B workflows, and custom integrations before touching production.

Verify the Patch Was Applied

The Commerce Version Tool (CVT) is the recommended verification method for both on-premises and Cloud infrastructure. Run it from your project root:

php vendor/bin/patch-status

Review the output for applied_patches, missing_patches, and per-CVE vulnerability_status. You want every relevant CVE showing as PROTECTED. Any VULNERABLE or UNKNOWN status means something is missing.

CVT ships with the July 2026 Isolated patch. If you do not have it yet, apply the July patch first to obtain it.

Cloud merchants: You can alternatively use the Quality Patches Tool to verify a specific patch file, or apply patches directly via Magento Cloud Patches. See the Cloud Patches Release Notes for the streamlined Cloud path.

Adobe has also introduced the Adobe Commerce Patching Automation — a standalone service within the Site Wide Analysis Tool that helps merchants view available patches and apply them through the Commerce Admin. Worth checking if you want to streamline this process going forward.

Are New Magento Installations Vulnerable Too?

Adobe fixed CVE-2026-103849 in APSB26-153, but the fix only reaches your store when you explicitly apply the Isolated patch. A fresh installation spun up from the standard Adobe Commerce installer does not have October pre-applied.

If you are standing up a new staging environment, a demo store, a client installation, or any fresh instance — apply the October Isolated patch immediately after installation. This is easy to overlook because a fresh setup feels clean and safe. It is not protected until you patch it.

What Should Magento Merchants Do Right Now? (8-Step Checklist)

✅ 1. Check your current version.

Admin → System → About Magento. Note the exact build including the monthly suffix.

✅ 2. Confirm prior months are applied.

Run php vendor/bin/patch-status if CVT is installed. September patches must be in place before October can be applied.

✅ 3. Apply the CVE-2026-75650 hotfix separately

if you have not already. It is not included in the October ZIP and covers the September StyleSmuggler vulnerability.

✅ 4. Download and apply the October Isolated patch

for your version, in correct component order, to staging first.

✅ 5. Apply the B2B October patch

if B2B is installed. The core patch alone does not fix CVE-2026-92909.

✅ 6. Run php vendor/bin/patch-status

after patching. Confirm every CVE in the bulletin shows as PROTECTED.

✅ 7. Deploy to production during a low-traffic window

with a rollback plan ready.

✅ 8. Rotate your encryption key and the credentials tied to it.

Adobe strongly recommends this as part of remediation. A new key alone does not invalidate credentials that may already be exposed, so also rotate Admin passwords, integration tokens, and payment gateway and third-party API credentials.

APSB26-153 FAQs

What is APSB26-153?

APSB26-153 is Adobe’s October 13, 2026 security bulletin for Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. It fixes 11 vulnerabilities that can lead to arbitrary code execution, privilege escalation, arbitrary file system write, and security feature bypass.

Which Magento versions need the APSB26-153 patch?

Adobe Commerce 2.4.4 through 2.4.9, Adobe Commerce B2B 1.3.3 through 1.5.3, and Magento Open Source 2.4.6 through 2.4.9 — September 2026 builds and earlier. Each version line has its own October 2026 Isolated patch ZIP.

What is CVE-2026-103849 (BlockStrap)?

CVE-2026-103849 is a CVSS 10.0 flaw in how Magento’s template engine processes certain block directives. An unauthenticated attacker can inject PHP into the rendering path and execute it remotely. Sansec named it BlockStrap.

Does the core APSB26-153 patch fix the B2B vulnerabilities?

No. If you run Adobe Commerce B2B, you must apply both the core October patch and the matching B2B October patch to fix CVE-2026-92909 and CVE-2026-92908.

Is the CVE-2026-75650 hotfix included in APSB26-153?

No. The CVE-2026-75650 hotfix from the September StyleSmuggler campaign is documented separately in APSB26-146 and must be applied in addition to the October Isolated patch.

Is APSB26-153 available as a Composer package?

No. APSB26-153 ships as Isolated patch files only. Every prior monthly Isolated patch must already be applied, in release order, before you apply October.

Do I need to rotate my encryption key after applying APSB26-153?

Adobe strongly recommends it. Rotate your encryption key and the credentials tied to it, including Admin passwords, integration tokens, and payment gateway and third-party API credentials, because a new key alone does not invalidate credentials that may already be exposed.

How do I check whether APSB26-153 is applied?

Run php vendor/bin/patch-status (the Commerce Version Tool) from your project root. Every CVE in the bulletin should show PROTECTED; any VULNERABLE or UNKNOWN status means a patch is missing.

How Aims Infosoft Can Help

Getting this right across a stack with B2B, PageBuilder, and custom modules — while managing the cumulative sequence requirement and the separate CVE-2026-75650 hotfix — is more involved than it looks. One wrong order or missed component file leaves vulnerabilities open that you thought were closed.

If you want someone who has done this across hundreds of Magento environments to handle it cleanly, reach out.

👉 Contact Aims Infosoft for APSB26-153 Patch Assistance →

Aims Infosoft — #1 Magento Solutions Provider | 10+ Years | 50,000+ Stores Served | 52+ Products | 12+ Extensions

References & Sources

• Adobe Experience League KA-49323 — https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-49323
• Adobe Security Bulletin APSB26-153 — https://www.adobe.com/trust/security/products/commerce/apsb26-153.html
• Sansec BlockStrap Research — https://sansec.io/research/blockstrap-magento-rce