Adobe's October security update, APSB26-153, came out on 13 October. It covers eleven vulnerabilities in Adobe Commerce, Magento Open Source and Adobe Commerce B2B, five of them critical. The worst is CVE-2026-103849, scored 10.0, which allows arbitrary code execution through the template engine and needs no login. Adobe rates the update Priority 2 and says it isn't aware of any of these being exploited. That was true when it was published, so check the bulletin again before you rely on it.
Which versions
Adobe Commerce 2.4.4 to 2.4.9, Magento Open Source 2.4.6 to 2.4.9, and B2B 1.3.3 to 1.5.3 are affected if they're on the September release or earlier. The fixed builds are the -2026-oct releases for each line, for example 2.4.8-2026-oct. Three of the B2B issues are authorisation bugs that let a user bypass security features or, in one case, run code.
How it's delivered
This is the bit that catches people out. The fixes come as isolated patch files only, and Adobe has deliberately not published Composer packages for this release. The patches also aren't cumulative, so you need to be on the latest -p release for your line and apply any you missed in release order.
What to apply
- The October patch for each component you run: Commerce or Open Source, plus B2B if you have it.
- The separate hotfix for CVE-2026-75650 from the earlier APSB26-146 bulletin (7 September). It isn't in the October patch and Adobe says to apply it alongside.
- If you're on Adobe Commerce Cloud, use the latest cloud-patches update. Adobe warns that putting the isolated patch on top of it can cause installation failures.
The revised 2.4.8-p5 patch
Adobe changed the Community Edition patch for 2.4.8-p5 after release, and kept the filename (248p5-2026-10-001-CE.patch). If you applied it before 16 October, you have the original. Adobe says the original still carried the fix and the revision is extra hardening, but the version tool may show your patches as UNKNOWN.
To check, run php vendor/bin/patch-status from the project root. If 248p5-2026-10-002-CE is listed as missing, you've got the original file. Download the current patch, reverse the old one, apply the new one, and test in staging first. If it still says UNKNOWN afterwards, send Adobe Support the full output.
What we'd do first
Check what's missing with patch-status, then sort the CVE-2026-75650 hotfix, because that's the one people forget. If you'd rather not do it yourself, we can jump on a call to discuss options.
Sources: Adobe bulletin APSB26-153, Adobe KB ka-49323, Adobe KB ka-50927 (revised 2.4.8-p5 patch)
