Adobe Commerce: Improper input validation leading to code execution

Summary

Adobe Commerce, Adobe Commerce B2B and Magento Open Source contain an improper input validation flaw (CWE-20). An attacker with high privileges, such as an administrator account, can execute arbitrary code in the context of the current user, without user interaction. Because the scope is changed, the impact can reach beyond the vulnerable component, with a CVSS score of 9.1 (Critical). The flaw is fixed in the October 2026 security update of APSB26-153.

Affected

• Adobe Commerce 2.4.4 to 2.4.9 (all builds labeled 2026-sep and earlier)
• Adobe Commerce B2B 1.3.3, 1.3.4, 1.4.2, 1.5.2 and 1.5.3 (2026-sep and earlier)
• Magento Open Source 2.4.7 to 2.4.9 (2026-sep and earlier) according to the CNA record; the bulletin also lists 2.4.6, so 2.4.6 should be treated as affected
• Per the CVE record, the CVE is not mapped to a narrower version range than the bulletin.

Fixed in

• Adobe Commerce 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-oct
• Adobe Commerce B2B 1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, 1.3.3-2026-oct
• Magento Open Source 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct; no fixed 2.4.6 release for Open Source is listed, so move to 2.4.7 or later
• Pre-release builds 2.4.10-alpha1 and 1.5.4-alpha1 are not suitable for production
• The hotfix for CVE-2026-75650 is not part of the October patch file and must be applied separately

Workaround

Unknown.

Exploitation

• Adobe states it is not aware of any exploits in the wild for any issue in APSB26-153; this statement covers the whole bulletin, not this CVE alone.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• No public proof of concept was found.

Our recommendation

• Inventory all Adobe Commerce, B2B and Magento Open Source installations, and identify any Open Source installations on 2.4.6.
• Install the October 2026 patch and the separate hotfix for CVE-2026-75650, then test checkout and admin functions.
• Enforce multi-factor authentication for all admin accounts, restrict admin access by IP where possible, and remove unused accounts.
• Patch the whole bulletin, not only this CVE: CVE-2026-103849 (CVSS 10.0) can be exploited without authentication.
• Adobe rates the bulletin Priority 2; plan installation within about 30 days of release (by mid-November 2026).

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Adobe Security Bulletin APSB26-153 www.adobe.com
• Adobe KB ka-49323 (Isolated patch files) experienceleague.adobe.com
• Meetanshi: APSB26-153 security patches for Magento meetanshi.com
• CyberExperts: Adobe Commerce October 2026 cyberexperts.com
• Strix AI: CVE-2026-92464 www.strix.ai
• VulDB: CVE-2026-92464 vuldb.com
• Safeguard: APSB26-153 / CVE-2026-103849 safeguard.sh

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:44.