Security update available for Adobe Commerce - APSB26-73

On July 14, 2026, Adobe released a regularly scheduled security update for Adobe Commerce and Magento Open Source. This update resolves critical, important, and moderate vulnerabilities. Successful exploitation of these vulnerabilities could lead to arbitrary code execution, security feature bypass, and privilege escalation. More information can be found in the Adobe Security Bulletin (APSB26-73) here.

Notes:

To help ensure that the remediation for the issues listed in the Adobe Security Bulletin (APSB26-73), can be applied as promptly as possible, Adobe has also released an Isolated patch that resolves the issues in the Adobe Security Bulletin (APSB26-73). This allows merchants to apply the fix in isolation with fewer risks of delay due to potential integration issues.

Please apply the latest security updates as soon as possible. If you fail to do so, you will be vulnerable to these security issues, and Adobe will have limited means to help remediate the issue further.

Please contact Support Services if you encounter any issues applying the security patch/Isolated patch.

Description description

Affected products and versions

Adobe Commerce on Cloud infrastructure, Adobe Commerce on-premises, and Magento Open Source:

Resolution resolution

For Adobe Commerce on Cloud, Adobe Commerce on-premises, and Magento Open Source software

Note: This issue is resolved by the latest cloud-patches update. Attempting to apply the Isolated patch when the fix is already in place from the cloud-patches update can cause installation failures.

To help resolve the vulnerability for the affected products and versions, you must apply the Isolated patch, depending on your Adobe Commerce/Magento Open Source version.

Isolated Patch Details

Use the following attached Isolated patches, depending on your Adobe Commerce/Magento Open Source version:

Note: To apply an Isolated security patch file, merchants must be on the latest security-only patch release (the latest -p version) for their supported release line, as Isolated security fixes are tested exclusively against that version. See the Patch release schedule for more information.

Note: The ZIP file can include a separate patch file for each Adobe Commerce component (CE, EE, B2B, PageBuilder, etc.), and some components may have more than one file, each built for a different version of that component.

For each component installed in your environment, apply the one file whose version matches your installed version of that component. After applying, use the Commerce Version Tool (see below) to confirm your installation is fully patched.

Example: If you have Community Edition (CE) on version 2.4.6-p15, you would only need to apply:

If you have Enterprise Edition (EE) on 2.4.6-p15, you would apply:

If you have B2B and are on CE/EE 2.4.6-p15, you would first apply the same two files:

After that, depending on your installed B2B version, apply the matching B2B patch:

Download Isolated patches

For version 2.4.9

For version 2.4.8-p5

Note: This isolated patch applies only to 2.4.8-p5. If you are on an earlier patch level in this line, first update to 2.4.8-p5, then apply this isolated patch.

For version 2.4.7-p10

Note: This isolated patch applies only to 2.4.7-p10. If you are on an earlier patch level in this line, first update to 2.4.7-p10, then apply this isolated patch.

For version 2.4.6-p15

Note: This isolated patch applies only to 2.4.6-p15. If you are on an earlier patch level in this line (for example, 2.4.6-p14 or older), first update to 2.4.6-p15, then apply this isolated patch.

For version 2.4.5-p17

Note: This isolated patch applies only to 2.4.5-p17. If you are on an earlier patch level in this line, first update to 2.4.5-p17, then apply this isolated patch.

Note: After clicking the patch file link below for 2.4.5-p17 in a browser, merchants will see a pop-up dialog box, where they should enter their Composer public key as the username, and their Private key as the password.

For version 2.4.4-p18

Note: This isolated patch applies only to 2.4.4-p18. If you are on an earlier patch level in this line, first update to 2.4.4-p18, then apply this isolated patch.

Note: After clicking the patch file link below for 2.4.4-p18 in a browser, merchants will see a pop-up dialog box, where they should enter their Composer public key as the username, and their Private key as the password.

How to apply the Isolated patch

Unzip the file and see How to apply a composer patch provided by Adobe in our support knowledge base for instructions.

For Adobe Commerce on Cloud merchants only - How to tell whether the Isolated patches have been applied

Considering that it isn’t possible to easily check if the issue was patched, you might want to check whether the Isolated patch has been successfully applied.

You can do this by taking the following steps, using the file VULN-27015-2.4.7_COMPOSER.patch as an example:

Note:

Adobe is introducing a new tool with these security updates:

Since a monthly security release can include several patch files, use the Commerce Version Tool below to confirm your installation is fully patched.

Commerce Version Tool: This tool is for both Adobe Commerce on-premises and Adobe Commerce on Cloud infrastructure environments. A standalone executable included with each monthly Adobe Commerce security patch. It helps merchants to verify patch coverage by reporting which monthly security patches are installed, which are missing, and which CVEs the installation is protected against. Note that the Commerce Version Tool is only available after a merchant applies the CE (Community Edition) patch file. Note that Adobe Commerce security patches are non-cumulative and must be applied in sequence. Additional information is available here.

Security updates

Security updates available for Adobe Commerce:

Why This Month’s Security Patches Are Not Available as Composer Packages

As outlined in the official Adobe Commerce release schedule (available on Experience League: Release Schedule), the security fixes released on July 14, 2026, for Adobe Commerce versions 2.4.9, 2.4.8, 2.4.6, 2.4.5, and 2.4.4 were classified as Isolated security fixes.

For this type of release, Adobe provides the fixes as Isolated patch files only, and Composer packages aren’t published alongside them. This is intentional: Isolated patches are designed to give merchants a fast, lightweight way to apply critical security fixes without needing to go through a full Composer-based update cycle, which can take longer and may involve additional dependency resolution.

For merchants on Adobe Commerce on Cloud infrastructure:

These security patches can also be applied directly through Magento Cloud Patches.

You can find the relevant details here: Cloud Patches – Release Notes. This gives Cloud merchants a streamlined path to stay current without manually managing the Isolated patch file.