Adobe has released its October security update for Adobe Commerce and Magento Open Source. If your business runs on Magento, make time to review your store’s patch status with your developer.
What has Adobe fixed?
Published on 13 October 2026, APSB26-153 addresses 11 vulnerabilities, including five rated critical. The most severe, CVE-2026-103849, has a CVSS score of 10.0 and can allow arbitrary code execution without authentication. Other issues include privilege escalation, arbitrary file writes and security feature bypass.
Adobe assigns the release Priority 2 and says it is not aware of exploitation in the wild for the issues covered by this bulletin. That is the position reported by Adobe, rather than a reason to postpone patching.
Does this affect your store?
The bulletin covers Adobe Commerce, Magento Open Source and Adobe Commerce B2B. Affected versions include September 2026 patch levels and earlier on the listed release lines. Check the official bulletin against your exact edition, release and installed components.The previous hotfix still matters. Adobe explicitly requires the CVE-2026-75650 hotfix in addition to these security updates. Applying October’s isolated patch alone does not satisfy that requirement.
Updating the version number is not the whole check
Adobe supplies this month’s fixes as isolated patch files, without accompanying Composer packages. The isolated patches require the latest security-only release for the supported branch, plus previous monthly isolated patches applied in order.
Apply the files matching your installed components, then verify coverage using Adobe’s Commerce Version Tool. Magento Open Source patch downloads are available for 2.4.7 and later; older installations need a review of their supported remediation options.
Our recommended next steps
- Confirm your starting point. Record your edition, version, extensions and existing patch history.
- Prepare a recovery route. Take a fresh backup and check that you can restore it.
- Test on staging. Apply the appropriate fixes and test checkout, payments, customer accounts, admin access and integrations.
- Deploy and verify. Agree a maintenance window, check patch coverage and monitor the store afterwards.
Keep application patching on your maintenance schedule alongside hosting and firewall management. A working storefront is not evidence that its security fixes are current.
Unsure where your store stands?
Contact DX3webs with your Magento version and your developer’s details. We can help review the hosting side and coordinate the next steps with your development team.
Sources: Adobe security bulletin APSB26-153 and Adobe’s patch application guidance. Checked 16 October 2026.