Online stores on Adobe Commerce and Magento have a no-login takeover bug. Install the October update

If your online store runs on Adobe Commerce or Magento Open Source, this week’s Adobe bulletin has a bug rated 10.0 that needs no login. Adobe says it has not seen attacks, but shop platforms are where attackers have gone before, and Adobe rates the update priority 2 for that reason.

A no-login bug rated 10.0 in Adobe Commerce. No attacks yet, and online stores are usually the first to get hit.

Adobe fixes a 10.0 bug in Commerce and Magento

Adobe published APSB26-153 on October 13. It fixes 11 vulnerabilities in Adobe Commerce, Commerce B2B and Magento Open Source. The worst, CVE-2026-103849, is a template-engine injection that allows code execution without authentication, scored 10.0. CVE-2026-92909 in the B2B module allows code execution without authentication too, scored 9.8. Two stored cross-site scripting bugs, CVE-2026-91013 and CVE-2026-100133, are rated critical.

The same release round covered 11 Adobe products and about 176 bugs, according to SecurityWeek, including 32 in ColdFusion with critical code-execution flaws. Adobe says it is not aware of exploitation of any of them.

Every Commerce and Magento store on September builds

Affected builds are Adobe Commerce 2.4.4 through 2.4.9 up to the September 2026 patch level, Commerce B2B 1.3.3 through 1.5.3, and Magento Open Source 2.4.6 through 2.4.9. Stores on those lines handle customer accounts and checkout pages, which is what makes them worth attacking.

Adobe also reminds merchants that the September 7 hotfix for CVE-2026-75650 (APSB26-146) is separate. A store that installs only the October update is still missing it.

Install the October Commerce patch and the September hotfix

• Upgrade to the October releases: 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct or 2.4.4-2026-oct; B2B 1.5.3-2026-oct and the matching older lines.
• Confirm the APSB26-146 hotfix for CVE-2026-75650 is installed as well.
• If you run ColdFusion, put its October update on the same change ticket.
• Ask your agency or hosting partner which patch level each storefront is on if you do not manage the code yourself.

Details

• APSB26-153, October 13, 2026, priority 2. CVE-2026-103849 (template injection, unauthenticated code execution, CVSS 10.0); CVE-2026-92909 (B2B incorrect authorization, unauthenticated code execution, 9.8); CVE-2026-91013 and CVE-2026-100133 (stored XSS, 9.3).
• Also apply: APSB26-146 hotfix for CVE-2026-75650 (September 7, 2026).
• Exploitation: none known, per Adobe.

Hunt / verify

• Admin users or integration tokens in the Commerce admin panel that nobody on your team created.
• New or changed CMS blocks, email templates and widgets that contain unexpected template directives or script tags.
• Web server logs for unusual POST requests to storefront and B2B endpoints from single IP addresses.

Source: Adobe APSB26-153; SecurityWeek on Adobe’s October fixes

Sources

• Adobe: Security update available for Adobe Commerce, APSB26-153
• SecurityWeek: Adobe Patches 176 Vulnerabilities Across 11 Products
• CVE.org: CVE-2026-103849

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].