Magento Security Patch APSB26-92 — What Merchants Need to Know
Adobe released the APSB26-92 security patch on 11 August 2026, fixing seven vulnerabilities in Adobe Commerce and Magento Open Source — including a pre-authentication privilege escalation rated CVSS 9.1. Here’s the honest picture: what it fixes, whether you’re affected, and how to patch.
APSB26-92 is Adobe’s August 2026 scheduled security update for Adobe Commerce and Magento Open Source, released on 11 August 2026. It resolves seven vulnerabilities — critical, important and moderate — the most serious being a pre-authentication privilege escalation flaw rated CVSS 9.1. If you run Magento or Adobe Commerce, APSB26-92 almost certainly affects your version, and this guide gives you the straight facts: what it fixes, how urgent it really is, whether you’re affected, and exactly how to apply the patch — without the manufactured panic that surrounds every security bulletin.
Search intent: urgent/informational — Magento merchants, developers and agencies who’ve seen the August 2026 security advisory and need to know what APSB26-92 is, how serious it is, and what to do. We cover the bulletin, the seven CVEs, affected versions, patching (full and Isolated Patch), and a notable change to how Adobe reports CVEs. It follows our coverage of the previous APSB26-73 July patch.
The honest urgency read: Adobe rates APSB26-92 Priority 2 and states it is not aware of any exploits in the wild for any of these issues. This is a scheduled monthly patch, not an actively-exploited emergency. That said, two of the critical flaws need no authentication at all — so an unpatched, internet-facing store is remotely reachable. The right response is to patch promptly on your normal cadence, testing on staging first — not to panic, and not to ignore it.
APSB26-92: What the August 2026 Patch Is
APSB26-92 is a regularly scheduled Adobe security update, following the monthly cadence that produced APSB26-73 in July. Adobe releases these bulletins to fix vulnerabilities its own security team and external researchers have found, before attackers do. The bulletin covers Adobe Commerce, Magento Open Source and Adobe Commerce B2B, and resolves vulnerabilities whose successful exploitation could lead to security feature bypass, arbitrary code execution and privilege escalation.
Crucially — and this is the fact that should shape your response — Adobe states it is not aware of any exploits in the wild for any of the issues in APSB26-92, and rates the whole update Priority 2. In Adobe’s rating system, Priority 2 means the update resolves vulnerabilities in a product that has historically been at elevated risk, but there is no known exploitation and no greater-than-usual risk at the moment of release. That is a materially different situation from an actively-exploited zero-day, and it means the correct response to APSB26-92 is disciplined, prompt patching — not a fire drill.
APSB26-92: The Seven CVEs, Ranked by Real Risk
APSB26-92 fixes seven CVEs, but they are not equal, and understanding which ones matter most helps you gauge your real exposure. The headline is CVE-2026-71362: an Incorrect Authorization flaw leading to privilege escalation, rated CVSS 9.1 Critical. What makes it the one to lead with is its attack profile — it requires no authentication and no admin privileges (CVSS vector AV:N/AC:L/PR:N/UI:N), meaning an anonymous, remote attacker could reach it against an unpatched store. That pre-auth, no-interaction combination is why it tops the list.
The second-most-serious in APSB26-92 is CVE-2026-48413, a stored cross-site scripting (XSS) flaw leading to arbitrary code execution, rated CVSS 8.7 Critical. It needs a low-privilege authenticated user (no admin rights) and victim interaction, so its reach is narrower than CVE-2026-71362, but a stored payload executing in an admin’s session is a serious outcome. Then comes CVE-2026-48416 (CVSS 7.5 Critical), the second unauthenticated flaw — an Incorrect Authorization issue enabling a security-feature bypass with no credentials required.
| CVE | Type / impact | CVSS | Auth needed? | Admin needed? |
|---|---|---|---|---|
| CVE-2026-71362 | Incorrect Authorization → privilege escalation | 9.1 Critical | No | No |
| CVE-2026-48413 | Stored XSS → arbitrary code execution | 8.7 Critical | Yes (low) | No |
| CVE-2026-48414 | Stored XSS → arbitrary code execution | 7.7 Critical | Yes (low) | Yes |
| CVE-2026-48415 (B2B) | Incorrect Authorization → security feature bypass | 7.6 Critical | Yes (low) | No |
| CVE-2026-48416 | Incorrect Authorization → security feature bypass | 7.5 Critical | No | No |
| CVE-2026-48411 | Incorrect Authorization → security feature bypass | 6.8 Important | Yes (low) | Yes |
| CVE-2026-48412 | Incorrect Authorization → privilege escalation | 2.7 Moderate | Yes (high) | Yes |
The remaining CVEs in APSB26-92 — CVE-2026-48414 (stored XSS, 7.7), CVE-2026-48415 (a B2B-specific security-feature bypass, 7.6), CVE-2026-48411 (bypass, 6.8 Important) and CVE-2026-48412 (privilege escalation, 2.7 Moderate) — all require some level of authentication, so their real-world reach is narrower. They still belong in the patch, but the two unauthenticated criticals (CVE-2026-71362 and CVE-2026-48416) are what make applying APSB26-92 genuinely worthwhile rather than merely tidy. If you run Adobe Commerce B2B, note that CVE-2026-48415 specifically affects the B2B module.
APSB26-92: Am I Affected? Version Check
The affected-version list for APSB26-92 is broad, which is why most Magento and Adobe Commerce merchants should assume they need it until they’ve confirmed otherwise. Adobe lists every supported release line as affected at its pre-August patch level, meaning if you have not yet applied this August update, you are almost certainly running a vulnerable version. Check your current version against the table below.
| Product | Affected (and earlier) | Patched version |
|---|---|---|
| Adobe Commerce | 2.4.4 through 2.4.9, -2026-jul and earlier | 2.4.4-2026-aug … 2.4.9-2026-aug |
| Magento Open Source | 2.4.6 through 2.4.9, -2026-jul and earlier | 2.4.6-2026-aug … 2.4.9-2026-aug |
| Adobe Commerce B2B | 1.3.3 through 1.5.3, -2026-jul and earlier | 1.3.3-2026-aug … 1.5.3-2026-aug |
To confirm your version, check the Magento admin footer or run bin/magento --version on your server (our Magento CLI commands guide covers the useful ones). If your patch level is -2026-jul or earlier on any of these lines, APSB26-92 applies to you. The practical takeaway: unless you’ve already applied the August 2026 update, plan to. This is exactly the kind of check that belongs in a routine Magento security process, so that each monthly bulletin is a quick “confirm and schedule” rather than a scramble.
APSB26-92: How to Patch (Full Update vs Isolated Patch)
There are two routes to remediate APSB26-92, and Adobe provides both. The standard route is to update to the newest patched version for your release line — the -2026-aug releases (for example, 2.4.7-2026-aug). This is the recommended path and folds the security fixes into a full patch update. If you keep current on the monthly cadence, this is business as usual, and our Magento upgrade checklist walks the process safely.
The second route, which Adobe has again provided with APSB26-92 (as it did with APSB26-73), is the Isolated Patch. This applies just the security fixes in isolation, with fewer risks of delay from integration issues — useful when you need to remediate quickly but a full version update would take longer to test and deploy. One important caveat Adobe flags: to apply an Isolated Patch, you must be on the latest security-only patch release (the latest -p version) for your supported line, because the isolated fixes are tested only against that version. Whichever route you choose for APSB26-92, the non-negotiable step is the same:
Test on staging before production — this is Priority 2, not a five-alarm fire. Because APSB26-92 is not being actively exploited, you have the breathing room to do this properly: apply the patch on a staging environment first, run your regression and integration checks, then deploy to production. The pressure to skip staging that comes with an actively-exploited zero-day does not apply here. Patch promptly, but patch correctly. Rushing a patch straight to production and breaking checkout is its own kind of outage.
APSB26-92: A Notable Change to How Adobe Reports CVEs
One detail in APSB26-92 is easy to miss but worth understanding, because it changes how you’ll read future bulletins. Adobe added a note: effective 11 August 2026, it may assign a single CVE identifier to multiple internally-discovered vulnerabilities that share the same severity rating and CWE category, when a release includes systemic fixes. In plain terms, one CVE number in a future bulletin might represent several related issues Adobe found and fixed together, rather than exactly one flaw.
This matters for interpretation. It means you can no longer assume “number of CVEs” equals “number of distinct vulnerabilities” in Adobe’s bulletins — a single CVE could bundle a category of systemic fixes. It’s a sensible move by Adobe (grouping related internal findings reduces noise), but if you track CVEs for compliance or reporting, note the shift from APSB26-92 onward. For the practical purpose of patching, nothing changes: you still apply the update. It’s simply a reminder that Adobe’s CVE counts now describe how issues are reported, not a precise tally of distinct bugs.
How we handle a Priority 2 Magento patch like APSB26-92
We match urgency to the actual risk, not the CVSS headline. A 9.1 score looks alarming, and CVE-2026-71362 being pre-authentication genuinely warrants prompt action — but Priority 2 with no known exploitation means this is scheduled maintenance, not an incident. We patch it on the normal cadence, properly tested, rather than triggering an emergency change that risks breaking a working store.
We patch on staging first, every time. Because APSB26-92 is not actively exploited, there is no justification for skipping the staging test. We apply it to a staging environment, run regression and integration checks — especially around checkout and any custom code — then promote to production. A patch that breaks a store helps no one.
We treat monthly bulletins as routine, which is the whole point. Clients on a maintenance plan experience APSB26-92 as a quick “confirmed affected, scheduled for this week’s window” note, not a panic. Building the monthly Adobe patch into a security routine is exactly what turns each bulletin from a scramble into a non-event.
Frequently Asked Questions About APSB26-92
What is APSB26-92?
APSB26-92 is Adobe’s August 2026 scheduled security update for Adobe Commerce and Magento Open Source, released 11 August 2026. It fixes seven vulnerabilities — critical, important and moderate — that could lead to security feature bypass, arbitrary code execution and privilege escalation. The most serious is CVE-2026-71362, a pre-authentication privilege escalation rated CVSS 9.1.
How urgent is APSB26-92 — is it being exploited?
Adobe rates it Priority 2 and states it is not aware of any exploits in the wild for any of the issues. So it is not an actively-exploited emergency, but two critical flaws (CVE-2026-71362 and CVE-2026-48416) require no authentication, making an unpatched internet-facing store remotely reachable. Patch promptly on your normal cadence, testing on staging first — prompt but not panicked.
Which Magento versions does APSB26-92 affect?
Broadly all supported lines at their pre-August level: Adobe Commerce 2.4.4 through 2.4.9, Magento Open Source 2.4.6 through 2.4.9, and Adobe Commerce B2B 1.3.3 through 1.5.3 — all at -2026-jul and earlier. If your patch level is -2026-jul or earlier, you are affected. Check with bin/magento –version and apply the -2026-aug release for your line.
What is CVE-2026-71362?
It is the most serious flaw in APSB26-92: an Incorrect Authorization vulnerability leading to privilege escalation, rated CVSS 9.1 Critical. What makes it the priority is that it requires no authentication and no admin privileges (vector AV:N/AC:L/PR:N/UI:N), so an anonymous remote attacker could reach it on an unpatched store. It is the reason to apply this patch promptly.
How do I apply the APSB26-92 patch?
Two routes. The standard one is updating to the newest patched version for your line — the -2026-aug releases (e.g. 2.4.7-2026-aug). The second is Adobe’s Isolated Patch, which applies just the security fixes in isolation for faster remediation, but requires you to be on the latest -p security release for your line. Either way, test on staging before production.
What is the Isolated Patch for APSB26-92?
The Isolated Patch applies only the APSB26-92 security fixes, in isolation from a full version update, so merchants can remediate quickly with fewer integration-related delays. Adobe provided it again this month, as it did with APSB26-73. The caveat: you must already be on the latest security-only (-p) patch release for your supported line, since the isolated fixes are tested only against that version.
Why does APSB26-92 mention a change to CVE identifiers?
Adobe noted that from 11 August 2026 it may assign a single CVE identifier to multiple internally-discovered vulnerabilities sharing the same severity and CWE category when a release includes systemic fixes. So a single CVE number in future bulletins might represent several related issues. It does not change how you patch, but it means CVE counts now describe reporting, not a precise tally of distinct bugs.
Need APSB26-92 Applied Safely?
Our team applies Magento security patches on staging first, tests thoroughly, then deploys — so you’re protected without breaking a working store.
