On 12 May 2026, Adobe published security bulletin APSB26-49 for Adobe Commerce and Magento Open Source. It addresses vulnerabilities with potential impacts ranging from application denial of service to arbitrary code execution. The highest CVSS base score listed is 8.7.
Adobe said it was not aware of any exploits in the wild for the issues covered by the bulletin. Still, if your store runs an affected version, you should identify the appropriate update and plan its deployment.
What’s in the patch?
APSB26-49 addresses vulnerabilities across several categories. The issues merchants should be aware of include:
Critical vulnerabilities (CVSS 7.4–8.7):
-
CVE-2026-34686 (CVSS 8.7): Stored cross-site scripting (XSS), with arbitrary code execution listed as a potential impact.
-
CVE-2026-34653 (CVSS 8.7): Path traversal, with arbitrary file system write listed as a potential impact.
-
CVE-2026-34645 and CVE-2026-34646 (CVSS 7.5 each): Incorrect authorisation that could lead to security feature bypass.
-
CVE-2026-34647 (CVSS 7.4): Server-side request forgery (SSRF) that could lead to security feature bypass.
-
CVE-2026-34648 to CVE-2026-34651 (CVSS 7.5 each): Uncontrolled resource consumption that could cause application denial of service.
-
CVE-2026-34652 (CVSS 7.5): A vulnerable third-party component dependency that could cause application denial of service.
Important vulnerabilities include:
-
CVE-2026-34654 (CVSS 5.3): A vulnerable third-party component dependency.
-
CVE-2026-34655 (CVSS 4.8): Stored XSS.
-
CVE-2026-34656 (CVSS 4.3): Improper access controls.
The stored XSS and path traversal issues warrant particular attention because of the potential impacts Adobe lists. However, the conditions for exploiting each vulnerability differ. Use the bulletin’s vulnerability details to assess which issues are relevant to your installation rather than assuming every store faces the same exposure.
The timing creates a decision point
Adobe Commerce and Magento Open Source 2.4.9 arrived in the same release period as APSB26-49. The new version brings broader platform changes alongside the security fixes. Hyvä Theme 1.4.6 also added compatibility with Magento 2.4.9 and PHP 8.5.
If you were already planning a 2.4.9 upgrade, check whether that project can be fully tested and deployed within your security timetable. If it needs more time, you can assess the appropriate security update for your current release line and continue the larger upgrade separately.
Adobe lists updated releases for several version lines, including 2.4.8-p5, 2.4.7-p10 and 2.4.6-p15, as well as 2.4.9. Older Adobe Commerce release lines and Adobe Commerce B2B have their own listed updates. Check the affected and updated version tables against the versions actually installed on your store.
Recommended action plan
Start with your current installation:
-
Confirm your versions: Check your Adobe Commerce or Magento Open Source version and, if applicable, your Adobe Commerce B2B package version.
-
Identify the applicable update: Match those versions to Adobe’s APSB26-49 solution table.
-
Test in staging: Check checkout, customer accounts, admin workflows, integrations, and third-party modules that matter to your store.
-
Schedule production deployment promptly: Once testing is complete, set a date based on your exposure and patching policy. On Tap recommends aiming to deploy within seven days where practical.
If you’re planning a 2.4.9 upgrade:
A full version upgrade can require more compatibility work than a security update on your existing release line. If 2.4.9 will take longer to test, deploy the applicable update for your current line first. You can then complete the broader upgrade with the necessary testing for extensions, integrations, and infrastructure.
If you use Hyvä:
Include theme and extension compatibility in your staging checks. Hyvä Theme 1.4.6 supports Magento 2.4.9 and PHP 8.5, but you should still test it against your store’s customisations. Where practical, deploy and verify the security update before introducing a separate theme update. This makes any issues easier to identify.
What this means for PCI DSS
Under PCI DSS v4.0.1 requirement 6.3.3, applicable patches for vulnerabilities your organisation ranks as critical must be installed within one month of release. Other applicable patches follow time frames determined by your assessment of risk.
That one-month period is a maximum for patches in the critical category, not a reason to wait if an update can be safely deployed sooner. Document your risk assessment, testing, deployment date, and any issues resolved along the way. These records will support your ongoing patch management and PCI DSS assessment.
Build a repeatable patch process
APSB26-49 is a reminder of the value of knowing exactly which platform and package versions your store runs. When a bulletin is published, that information lets your team quickly establish whether an update applies and what needs testing.
If each patch requires days of manual preparation, review your staging coverage and deployment process. A reliable path from bulletin review to production helps you act promptly while protecting checkout, admin operations and integrations.
About On Tap
On Tap is an eCommerce agency specialising in Adobe Commerce, Magento Open Source and Shopify. We help merchants assess security updates, test compatibility and plan deployments around their store’s customisations and integrations. If you need support with APSB26-49 or your 2.4.9 upgrade, get in touch with our team.
