Urgent Action Required: Critical Security Update Available for Adobe Commerce (APSB26-146)

Last update: September 21, 2026
IMPORTANT
This is an urgent update related to CVE-2026-75650. Adobe is aware that CVE-2026-75650 has been exploited in the wild targeting Adobe Commerce merchants.

On September 07, Adobe released a critical security update affecting Adobe Commerce and Magento Open Source. Adobe became aware of a zero-day vulnerability in Adobe Commerce and has released a security update (APSB26-146) to resolve it. The vulnerability could allow an unauthenticated attacker to execute arbitrary code on an affected installation (CVE-2026-75650).

Adobe has released Security Bulletin APSB26-146, which addresses this vulnerability. The bulletin is available here:

Security update available for Adobe Commerce | APSB26-146

This article explains how to apply the hotfix for current and earlier versions of Adobe Commerce and Magento Open Source.

Description

Affected products and versions:

Adobe Commerce versions:

  • 2.4.9-2026-aug and earlier
  • 2.4.8-2026-aug and earlier
  • 2.4.7-2026-aug and earlier
  • 2.4.6-2026-aug and earlier
  • 2.4.5-2026-aug and earlier
  • 2.4.4-2026-aug and earlier

Adobe Commerce B2B versions:

  • 1.5.3-2026-aug and earlier
  • 1.5.2-2026-aug and earlier
  • 1.4.2-2026-aug and earlier
  • 1.3.4-2026-aug and earlier
  • 1.3.3-2026-aug and earlier

Magento Open Source versions:

  • 2.4.9-2026-aug and earlier
  • 2.4.8-2026-aug and earlier
  • 2.4.7-2026-aug and earlier
  • 2.4.6-2026-aug and earlier

Resolution

Solution for Adobe Commerce on Cloud, Adobe Commerce on-premises, and Magento Open Source

NOTE
The hotfix for CVE-2026-75650 is now compatible with all the Adobe Commerce and Magento Open Source versions between 2.4.4 - 2.4.7. Please refer the table below and download the patch applicable for your version.

To help resolve the vulnerability for the affected products and versions, you must apply the below patch (depending on your version) and rotate your encryption keys.

Version NumberPatch
2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug, 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul, 2.4.8-p5, 2.4.8-p4, 2.4.7-p10, 2.4.7-p9, 2.4.6-p15, 2.4.6-p14, 2.4.5-p17, 2.4.5-p16, 2.4.4-p18, 2.4.4-p17Hotfix VULN-39341-composer-patches.zip
2.4.8-p3, 2.4.8-p2VULN-39341_248-p3.patch.zip
2.4.8-p1, 2.4.8VULN-39341_248-p1.patch.zip
2.4.7-p8, 2.4.7-p7VULN-39341_247-p8.patch.zip
2.4.7 - 2.4.7-p6VULN-39341_247-p5.patch.zip
2.4.6-p13, 2.4.6-p12, 2.4.5-p15, 2.4.5-p14, 2.4.4-p16, 2.4.4-p15VULN-39341_246-p13.patch.zip
2.4.6 - 2.4.6-p11, 2.4.5 - 2.4.5-p13, 2.4.4 - 2.4.4-p14VULN-39341_246-p11.patch.zip

How to apply the hotfix

Unzip the file and see How to apply a composer patch provided by Adobe in our support knowledge base for instructions.

Confirm the hotfix is applied (Adobe Commerce on Cloud merchants only)

Considering that it isn’t possible to easily determine if the issue was patched, it’s recommended that you check whether the CVE-2026-75650 hotfix has been successfully applied.

You can do this by taking the following steps, using the file VULN-39341_Hotfix_COMPOSER.patch as an example:

  1. Install the Quality Patches Tool.
  2. Run the command: vendor/bin/magento-patches -n status | grep "39341\|Status".
  3. You should see output similar to this, where this example VULN-39341 returns the Applied status:
IDTitleCategoryOriginStatusDetail
N/A…/m2-hotfixes/VULN-39341_Hotfix_COMPOSER.patchOtherLocalAppliedPatch type: Custom

Rotate the credentials after applying the patch

To fully remediate this issue, rotate not only your encryption key but all credentials that may have been encrypted or exposed using it, including server, API, and integration credentials.

NOTE
The encryption key is used to encrypt integration tokens, payment gateway credentials, and system-privileged automation tokens. Rotating the encryption key alone does not invalidate credentials that may already have been exposed. Rotate all associated credentials at their source (for example, at the payment gateway or third-party service), not only within Commerce.

To rotate credentials, follow these steps:

  1. Apply the hotfix.
  2. Enable maintenance mode.
  3. Disable cron execution (Commerce on Cloud command: vendor/bin/ece-tools cron:disable).
  4. Rotate your encryption keys.
  5. Rotate all Admin panel user passwords.
  6. Deactivate and regenerate all REST/SOAP/GraphQL integration tokens (System > Extensions > Integrations).
  7. Rotate OAuth client secrets for any connected third-party applications.
  8. Rotate payment gateway API credentials at the provider level (Stripe, Braintree, Adyen, PayPal, etc.).
  9. Rotate database and Fastly credentials (via support ticket).
  10. Rotate SSH/deploy keys and any cron or system-privileged service account credentials.
  11. Rotate API keys for shipping, tax, and other integrated third-party extensions.
  12. Flush the cache.
  13. Enable cron execution (Commerce on Cloud command: vendor/bin/ece-tools cron:enable).
  14. Disable maintenance mode.
  15. Commerce on Cloud only: Redeploy to apply new database credentials.

Security updates

Security updates available for Adobe Commerce:

Enable or disable maintenance mode in the Adobe Commerce Installation Guide

Announcements

Get hands-on with agentic AI.

Explore how AI agents work together through real examples and hands-on practice. Join your local User Group to design an agent workflow with your peers and leave with a practical framework you can apply to your own work.

Find an event

Ask AI

Not sure where to start?
Ask me anything about Adobe products.

Type your question or pick a suggestion below.

Use of this AI chatbot is subject to Adobe's Privacy Policy. Don't share sensitive data. AI responses are not your Content, may be inaccurate, and any offers provided are non-binding. Generative AI Terms.

Ask AI