Adobe Commerce October 2026 Security Update: What Store Owners Need to Know

On October 13, 2026, Adobe released a security update, numbered APSB26-153, for Adobe Commerce, Adobe Commerce B2B and Magento Open Source. It fixes 11 security issues, including a critical one, CVE-2026-103849 (named Blockstrap by security firm Sansec), which scores the maximum 10.0 out of 10. Adobe says it is not aware of any of the issues being used against real stores.

• What it is: a security update that strengthens the software behind your store

• Who needs it: anyone running Adobe Commerce, Adobe Commerce B2B or Magento Open Source on a release from September 2026 or earlier

• How serious: Adobe rated it priority 2. Five of the 11 fixes carry its highest severity label, "critical"

• Good news: Adobe is not aware of any of these weaknesses being used in the wild, meaning against real stores

• What to do: apply the October update, and confirm the September hotfix is in place too

Updating promptly is still best practice. These fixes are public, so the sooner your store has them, the better protected it stays.

If your store runs on Adobe Commerce or Magento Open Source, the answer is yes, unless it has already been updated to an October 2026 release. This includes stores using Adobe Commerce B2B.
Adobe has published matching October 2026 updates for current versions, so you can choose the one that matches your store's version. Stores on much older versions, such as Magento Open Source 2.4.6, may need a full upgrade instead. Magento 2.4.9, released in May 2026, is the latest stable version, and moving to it involves its own planning, from extension compatibility to hosting requirements.

Learn more about Magento 2.4.9 in our guide to see what has changed and how to prepare.

Adobe fixed 11 issues: five rated critical, five high and one medium.

Critical

High

Medium

Three of the 11 issues apply only to Adobe Commerce B2B (marked B2B in the tables above), so stores with B2B features should check these as well.

Sansec, a security firm that tracks threats to eCommerce stores, published its own research on October 15, 2026 and named CVE-2026-103849 Blockstrap. It is the most serious fix in this update, with a CVSS score of 10.0 out of 10. Sansec describes it as an issue in Magento and Adobe Commerce that allows remote code execution without a login, which means someone could run their own instructions on a store's server.

Technically, Blockstrap is a template engine injection (CWE-1336), where data that should be treated as plain text can be processed as a template instruction. Sansec explains that attacker-controlled data in a child template can be signed and rescanned at the root level, which lets a smuggled directive run. Adobe's fix replaces the generic template rescan with registered placeholders.

Sansec's write-up also describes Blockstrap as building on StyleSmuggler, an earlier issue that Sansec reports reached mass exploitation within three days of Adobe's September hotfix. Adobe is not aware of any exploits of Blockstrap, but this history is a good reason to apply the October update promptly.

For more detail, read Sansec's Blockstrap research.

On September 7, 2026, Adobe released an earlier critical update, APSB26-146. Adobe asks store owners to also apply the hotfix for CVE-2026-75650 alongside this October update. If you updated in September, it is worth confirming that the hotfix is in place too.

• Check which version of Adobe Commerce or Magento your store runs

• Confirm the September hotfix for CVE-2026-75650 is installed

• Apply the matching October (-2026-oct) update, first on a private test copy of your store (often called a staging site)

• Choose a quiet trading period to update the live store

• After the update, check that checkout, payments and your admin users all look right

• If your version is no longer covered, plan an upgrade

Adobe's security updates are designed to improve protection without adding other new features. Some of them include changes that may affect custom features or add-ons, which is why testing on a copy of your store first is a good idea.

If you run Adobe Commerce on Cloud on version 2.4.4 to 2.4.6, Adobe asks you to upgrade to a supported release, or move to Adobe Commerce as a Cloud Service, before your upgrade enforcement date.

Security updates like APSB26-153 arrive regularly, and each one means testing, installing and checking that your store's custom features still work. That is exactly the kind of work On Tap does every day.

On Tap is a full-service eCommerce agency with more than 400 experts and over 20 years of experience. We are a Magento Association Platinum Partner, and were named Best Full-Service eCommerce Agency 2026 at the Ecommerce Awards.

For Adobe Commerce and Magento merchants, we can help with:

• Evergreen: our service so you never pay for an Adobe Commerce or Magento patch or upgrade again

• Support and maintenance: keeping your store updated, secure and running smoothly

• AuditIQ: 360° site health monitoring to keep your websites up to date, secure and optimised

• Hosting, migration and development: from auto-scaling hosting to upgrades and custom builds

If you are unsure which version you are running, whether the September hotfix was applied, or how to schedule the October update smoothly around your trading, talk to us. Contact On Tap and our consultancy team will get back to you within 24 hours to discuss your store and the smoothest route to updating it.