DocumentationCommerceCommerce KB

Urgent Action Required: Critical Security Update Available for Adobe Commerce (APSB26-146)

Last update: September 7, 2026
IMPORTANT
This is an urgent update related to CVE-2026-75650. Adobe is aware that CVE-2026-75650 has been exploited in the wild targeting Adobe Commerce merchants.

On September 07, Adobe released a critical security update affecting Adobe Commerce and Magento Open Source. Adobe became aware of a zero-day vulnerability in Adobe Commerce and has released a security update (APSB26-146) to resolve it. The vulnerability could allow an unauthenticated attacker to execute arbitrary code on an affected installation (CVE-2026-75650).

Adobe has released Security Bulletin APSB26-146, which addresses this vulnerability. The bulletin is available here:

Security update available for Adobe Commerce | APSB26-146

This article explains how to apply the hotfix for current and earlier versions of Adobe Commerce and Magento Open Source.

Description

Affected products and versions:

Adobe Commerce versions:

  • 2.4.9-2026-aug and earlier
  • 2.4.8-2026-aug and earlier
  • 2.4.7-2026-aug and earlier
  • 2.4.6-2026-aug and earlier
  • 2.4.5-2026-aug and earlier
  • 2.4.4-2026-aug and earlier

Adobe Commerce B2B versions:

  • 1.5.3-2026-aug and earlier
  • 1.5.2-2026-aug and earlier
  • 1.4.2-2026-aug and earlier
  • 1.3.4-2026-aug and earlier
  • 1.3.3-2026-aug and earlier

Magento Open Source versions:

  • 2.4.9-2026-aug and earlier
  • 2.4.8-2026-aug and earlier
  • 2.4.7-2026-aug and earlier
  • 2.4.6-2026-aug and earlier

Resolution

Solution for Adobe Commerce on Cloud, Adobe Commerce on-premises, and Magento Open Source

To help resolve the vulnerability for the affected products and versions, you must apply the VULN-39341 patch (depending on your version) and rotate your encryption keys.

Compatibility note: Please note this hotfix has been tested only for the versions listed below. It may work on other supported versions, but this has not been officially verified.

Adobe Commerce versions:

  • 2.4.9-2026-aug
  • 2.4.8-2026-aug
  • 2.4.7-2026-aug
  • 2.4.6-2026-aug
  • 2.4.5-2026-aug
  • 2.4.4-2026-aug

Adobe Commerce B2B versions:

  • 1.5.3-2026-aug
  • 1.5.2-2026-aug
  • 1.4.2-2026-aug
  • 1.3.4-2026-aug
  • 1.3.3-2026-aug

Magento Open Source versions:

  • 2.4.9-2026-aug
  • 2.4.8-2026-aug
  • 2.4.7-2026-aug
  • 2.4.6-2026-aug

Apply the following hotfix to the affected product version:

How to apply the hotfix

Unzip the file and see How to apply a composer patch provided by Adobe in our support knowledge base for instructions.

Confirm the hotfix is applied (Adobe Commerce on Cloud merchants only)

Considering that it isn’t possible to easily determine if the issue was patched, it’s recommended that you check whether the CVE-2026-75650 hotfix has been successfully applied.

You can do this by taking the following steps, using the file VULN-39341_Hotfix_COMPOSER.patch as an example:

  1. Install the Quality Patches Tool.
  2. Run the command: vendor/bin/magento-patches -n status | grep "39341\|Status".
  3. You should see output similar to this, where this example VULN-39341 returns the Applied status:
ID
Title
Category
Origin
Status
Detail
N/A
…/m2-hotfixes/VULN-39341_Hotfix_COMPOSER.patch
Other
Local
Applied
Patch type: Custom

Rotate the credentials after applying the patch

To fully remediate this issue, rotate not only your encryption key but all credentials that may have been encrypted or exposed using it, including server, API, and integration credentials.

NOTE
The encryption key is used to encrypt integration tokens, payment gateway credentials, and system-privileged automation tokens. Rotating the encryption key alone does not invalidate credentials that may already have been exposed. Rotate all associated credentials at their source (for example, at the payment gateway or third-party service), not only within Commerce.

To rotate credentials, follow these steps:

  1. Apply the hotfix.
  2. Enable maintenance mode.
  3. Disable cron execution (Commerce on Cloud command: vendor/bin/ece-tools cron:disable).
  4. Rotate your encryption keys.
  5. Rotate all Admin panel user passwords.
  6. Deactivate and regenerate all REST/SOAP/GraphQL integration tokens (System > Extensions > Integrations).
  7. Rotate OAuth client secrets for any connected third-party applications.
  8. Rotate payment gateway API credentials at the provider level (Stripe, Braintree, Adyen, PayPal, etc.).
  9. Rotate database credentials.
  10. Rotate SSH/deploy keys and any cron or system-privileged service account credentials.
  11. Rotate API keys for shipping, tax, and other integrated third-party extensions.
  12. Flush the cache.
  13. Enable cron execution (Commerce on Cloud command: vendor/bin/ece-tools cron:enable).
  14. Disable maintenance mode.

Security updates

Security updates available for Adobe Commerce:

Enable or disable maintenance mode in the Adobe Commerce Installation Guide

recommendation-more-help
commerce-knowledge-base-help