If you run Adobe Commerce, Adobe Commerce B2B or Magento Open Source, check whether the August 2026 security update has been applied. Adobe published security bulletin APSB26-92 on 11 August 2026. It covers seven vulnerabilities, five of which Adobe rates critical.
The short version
The update addresses issues that could lead to security feature bypass, arbitrary code execution, or privilege escalation. Adobe assigned the update Priority 2 and recommends updating affected installations. In its bulletin, Adobe says it is not aware of exploitation in the wild for the issues addressed. That statement does not guarantee that an unpatched store is safe.
Who's affected
Adobe lists the following affected release lines, up to and including their July 2026 monthly security builds:
-
Adobe Commerce: 2.4.4 through 2.4.9
-
Adobe Commerce B2B: 1.3.3, 1.3.4, 1.4.2, 1.5.2 and 1.5.3
-
Magento Open Source: 2.4.6 through 2.4.9
The precise affected versions and corresponding August updates are listed in Adobe’s bulletin. Check the installed Commerce and B2B components separately. Adobe lists all deployment platforms for the affected versions.
What's actually broken
Adobe identifies seven CVEs. Its severity ratings and stated impacts are:
|
Severity |
Issue type |
Adobe’s stated impact |
CVSS |
Authentication required? |
|
Critical |
Incorrect authorisation |
Privilege escalation |
9.1 |
No |
|
Critical |
Stored cross-site scripting (XSS) |
Arbitrary code execution |
8.7 |
Yes |
|
Critical |
Stored XSS |
Arbitrary code execution |
7.7 |
Yes; admin privileges required |
|
Critical |
Incorrect authorisation, B2B component |
Security feature bypass |
7.6 |
Yes |
|
Critical |
Incorrect authorisation |
Security feature bypass |
7.5 |
No |
|
Important |
Incorrect authorisation |
Security feature bypass |
6.8 |
Yes; admin privileges required |
|
Moderate |
Incorrect authorisation |
Privilege escalation |
2.7 |
Yes; admin privileges required |
CVE-2026-71362 has the highest CVSS score, 9.1, and Adobe says it does not require authentication. The two stored XSS issues, CVE-2026-48413 and CVE-2026-48414, require authentication; the latter also requires admin privileges. Adobe marks CVE-2026-48415 as specific to B2B. These are potential impacts and prerequisites described by Adobe, not evidence that any particular store has been compromised. See the vulnerability details in Adobe’s bulletin for the CVEs and full CVSS vectors.
What to do
-
Check your patch status and apply the appropriate security update: Adobe lists August 2026 updated versions for each affected release line and recommends updating installations. Its August patch instructions explain the available isolated patches. Those patches depend on the matching July patches and, for older patch levels, the latest security-only patch in the relevant release line. Cloud infrastructure users should also check whether the fix is already present through Cloud Patches before applying an isolated patch.
-
Include B2B where it is installed: Check the version of each installed component and use its matching patch file. This matters both for the B2B-specific CVE and for confirming that the whole installation has been updated.
-
Schedule the work promptly: Adobe recommends applying the latest security updates as soon as possible. On Tap also recommends assessing your store’s exposure and maintenance window rather than waiting for a reported exploit.
-
Test and verify the deployment: Test against your store’s customisations before production deployment. After applying isolated patches, follow Adobe’s verification guidance to check which monthly patches are installed and whether the relevant CVEs show as protected.
Bottom line
APSB26-92 addresses five critical vulnerabilities, including one that Adobe rates 9.1 and says requires no authentication. Merchants on an affected installation should confirm that the appropriate August fixes, and any prerequisite patches, are in place. This article covers the August 2026 bulletin; check Adobe’s current security guidance when assessing your store’s overall patch status.
Following the release of APSB26-92, On Tap began rolling out the fixes to stores covered by its Evergreen programme. If you need help assessing or updating your store, get in touch with On Tap.
