APSB26-73: Adobe Commerce and Magento security patch - what merchants need to do

Adobe provides July 2026 isolated patch files for the applicable Adobe Commerce and Magento components. The files you need depend on your store’s release line and installed components. Adobe Commerce Events requires a separate module update: Adobe lists versions 1.6.0 to 1.20.0 as affected and version 1.21.0 as the update in its security bulletin.

Merchants should check their installed versions and components, then apply the relevant security fixes promptly. Two issues deserve particular attention:

• CVE-2026-48356, rated 9.6, is an unrestricted file upload vulnerability that could lead to privilege escalation.

• CVE-2026-48358, rated 9.1, affects webhooks and could lead to arbitrary code execution. Exploitation requires authentication and admin privileges.

Adobe said it was not aware of exploitation in the wild for the issues addressed by the bulletin.

Adobe provides July 2026 isolated patch files so merchants can apply the fixes without waiting for a full version upgrade. The correct files depend on the store’s release line and installed components.

What does this mean for merchants?

The risk differs by vulnerability and store configuration. The webhooks issue has a serious potential impact, but it requires an attacker with admin privileges. Other issues in the bulletin have different access requirements. Review Adobe’s vulnerability table against your version and installed components, including Adobe Commerce B2B and Adobe Commerce Events where applicable.

The affected core release lines listed by Adobe include Adobe Commerce 2.4.4 through 2.4.9. For Magento Open Source, the bulletin lists 2.4.6 through 2.4.9. The corresponding July fixes use labels such as 2.4.8-2026-jul, but these labels do not mean that a full Composer package is available for each line. Adobe supplied the July fixes as isolated patch files.

The playbook

Read the bulletin and assess your exposure

Check the APSB26-73 bulletin, your installed core version, and the versions of relevant components. Identify the latest -p baseline for your release line and any missing isolated patches.

Adobe’s Commerce Version Tool can report installed and missing monthly patches and the CVEs covered, once the applicable CE patch has made the tool available. Review earlier security updates as part of your assessment rather than assuming that applying July’s files resolves unrelated earlier issues.

Apply the matching July isolated patches

Follow Adobe’s APSB26-73 patch instructions. If your store is behind the latest -p baseline for its release line, update that baseline first. Download the ZIP for the correct line, then apply the files matching each installed component in Adobe’s specified order.

An Adobe Commerce installation with B2B can require CE, EE and B2B files. Applying only one file could leave part of that installation unpatched.

If your store uses Adobe Commerce Events, check its installed version separately. For affected versions 1.6.0 to 1.20.0, Adobe specifies an update to version 1.21.0. Updating Events is a separate step from applying the relevant core isolated patch files.

Test the change in staging, including the storefront, basket, checkout, payments, and admin functions relevant to your site. Then deploy through your normal controlled release process as promptly as possible. Use the Commerce Version Tool to check patch coverage afterwards. The commands and deployment time depend on your installation, so follow Adobe’s instructions and your project’s patch workflow.

Check the patch sequence and plan the next release

July’s isolated patches are not cumulative. Apply any later monthly isolated patches in order, unless a subsequent full -p release has incorporated them.

Since this article was first published in July, use Adobe’s current isolated patch policy, security bulletins, and the Commerce Version Tool to establish your store’s current status. Having the July patch alone does not establish that a store is up to date in September.

Adobe describes a full -p release as a cumulative security checkpoint. Isolated patches supply fixes between those releases.

Review WAF rules and monitoring

As part of your wider security review, check that your web application firewall rules, application logs and alerts are working. Investigate unusual admin activity, unexpected changes and suspicious requests. A WAF provides another layer of protection, but it does not establish that the Adobe fixes have been applied.

Review admin account hygiene

Remove unused administrator accounts and check access permissions and two-factor authentication. Investigate unfamiliar accounts or API tokens. If compromise or inappropriate access is suspected, rotate the affected credentials in line with your incident response process.

These checks support good security practice, but they do not replace the APSB26-73 patches.

Check for signs of prior compromise

If the store remained unpatched for an extended period or monitoring identifies suspicious activity, review administrator accounts, API tokens, changed files, scheduled tasks, injected scripts, and relevant configuration changes.

Patching addresses the vulnerabilities covered by the update. It does not, by itself, investigate or remove an existing compromise.

Document and update your patching process

Record the release line, baseline, component files applied, deployment date, test results and Commerce Version Tool output. Review any delay between Adobe’s bulletin and production deployment so future security releases can be assessed and applied efficiently.

Platform-specific guidance

Magento Open Source and Adobe Commerce on-premises

Use the Adobe bulletin to confirm affected versions and the APSB26-73 knowledge base article to select the correct isolated patch ZIP and component files. Follow Adobe’s linked application instructions, then verify coverage with the Commerce Version Tool.

Adobe says these July fixes were supplied as isolated files rather than corresponding Composer packages. A composer require command using a -2026-jul version is therefore not the installation route for this update.

Adobe Commerce on Cloud infrastructure

Check your installed Cloud Patches for the Commerce version before applying files manually. Adobe says the fix can already be included in the cloud-patches update, and applying it again manually can cause installation failures.

Validate the patch state and promote the change through your project’s normal integration, staging, and production workflow.

A note on the 2.4.6 release line

Regular support for Adobe Commerce 2.4.6 ended on 11 August 2026, but Adobe continues to provide support under its extended support and security-only arrangements. Those arrangements apply to Adobe Commerce customers; merchants running Magento Open Source should not assume the same support dates apply.

If your store runs 2.4.6, check which product you use, confirm the security fixes available for your installation, and prioritise an upgrade to a supported release.

Common pitfalls

1. Applying a patch for the wrong baseline or component: July’s files target specific -p, CE, EE, and B2B versions. Check the installed versions and follow Adobe’s file order.

2. Assuming the newest isolated patch includes earlier months: Monthly isolated files are non-cumulative. Check for gaps and apply missing files in sequence, or move to a later cumulative -p release where appropriate.

3. Duplicating a Cloud fix: Check Cloud Patches for Commerce before manually applying the same isolated patch.

4. Overlooking Adobe Commerce Events: If Events is installed, check its version and apply the separate module update specified in Adobe’s APSB26-73 bulletin.

5. Overlooking third-party modules: Review updates and compatibility for modules that interact with checkout, authentication, or customer data during regression testing.

About On Tap

On Tap supports Adobe Commerce and Magento merchants with security patch planning, deployment, regression testing, and monitoring. If you need help checking your store’s current patch coverage or applying the appropriate fixes, get in touch.