APSB26-153: 2.4.6-p15 October 2026 Patch Analysis

Adobe has released its October 2026 security update, APSB26-153, addressing 11 vulnerabilities across Adobe Commerce. The most severe issue, CVE-2026-103849, carries a CVSS score of 10.0 and involves unauthenticated remote code execution through the template engine.

Other vulnerabilities involve stored cross-site scripting (XSS), sensitive customer information, file system security and B2B authorisation. Adobe confirmed that none of the vulnerabilities were known to be actively exploited when the bulletin was published.

We’ve reviewed the isolated patch changes for Adobe Commerce 2.4.6-p15 to better understand the vulnerabilities being addressed and their potential impact.

Technical Insights

• Critical remote code execution – CVE-2026-103849
• Email template security
• Stored cross-site scripting vulnerabilities
• B2B authorisation vulnerabilities
• File system security – CVE-2026-95631
• Customer data and validation protections

For every release, we reverse-engineer the patch set to understand:

• Which Magento modules have changed.
• Which CVEs map to which areas of the codebase.
• How the vulnerabilities could realistically be exploited.
• Where bespoke modules or theme overrides may overlap with patched functionality.
• Which areas of the application require targeted regression testing.

Critical remote code execution – CVE-2026-103849

CVSS: 10.0 (Critical)

The most significant finding concerns how Magento processes deferred email-template directives. Our analysis identified changes to the template rendering process, introducing a registry and unpredictable placeholders to prevent attacker-controlled content from being interpreted as trusted template instructions.

This appears to address a server-side template injection vulnerability that could lead to remote code execution without authentication. These changes are the strongest match for CVE-2026-103849, rated CVSS 10.0.

Our analysis also identified a possible connection between template processing changes and CVE-2026-92909, a B2B-only vulnerability involving unauthenticated remote code execution.

Email template security

The updated validation prevents potentially malicious directives from being embedded within HTML attributes, CSS URLs and other parts of email templates. Protections have also been extended to unsaved email-template previews within the Admin.

These changes appear designed to address potential code execution or data-exfiltration vulnerabilities associated with malicious template content.

Stored cross-site scripting vulnerabilities

Several vulnerabilities involve stored cross-site scripting (XSS), including two critical issues rated 9.3. Stored XSS can occur when malicious content is saved within an application and subsequently executed when another user views that content.

Our analysis identified changes affecting:

• B2B company registration fields
• Email address validation
• HTML and WYSIWYG content sanitisation
• Reward history comments within the Admin.
• URL escaping and inline translation

Two unauthenticated stored-XSS vulnerabilities, CVE-2026-91013 and CVE-2026-100133, are rated critical. Our analysis suggests that the company region and email validation changes may relate to these vulnerabilities, although the exact mapping has not been confirmed.

B2B authorisation vulnerabilities

The isolated B2B patches introduce additional company ownership checks within purchase order approval and viewing functionality. Previously, the authorisation logic appeared to allow company administrators to access purchase orders without adequately confirming that the purchase order belonged to their company.

The new checks explicitly compare the purchase order’s company ID against the current company administrator’s company ID.

For B2B merchants, this is particularly important where multiple organisations operate within the same Adobe Commerce instance.

File system security – CVE-2026-95631

A change to Magento’s file-lock implementation replaces directly constructed filenames with SHA-256 hashes. This prevents supplied lock names containing directory traversal sequences from escaping the designated lock directory.

The previous implementation could potentially allow arbitrary file creation or writes outside the intended directory.

Customer data and validation protections

The update introduces additional protections within the customer repository. API search filters and sorting are now restricted for sensitive fields including password hashes, password reset tokens and confirmation values.

The changes appear designed to prevent attackers from using carefully constructed API queries to infer sensitive customer information. The patch also strengthens validation during product attribute mass updates.

Which Adobe Commerce versions are affected?

Adobe lists the September 2026 builds and earlier for the 2.4.4 through 2.4.9 Adobe Commerce release lines as affected.

Magento Open Source and supported Adobe Commerce B2B releases are also included in the security bulletin.

Adobe has published October 2026 security updates and isolated patches to address these vulnerabilities. The isolated patches allow merchants to apply the relevant security fixes without necessarily undertaking a wider feature or platform upgrade.

However, these patches have specific prerequisites. Merchants must be on the appropriate security patch level and have applied earlier monthly isolated patches in the required sequence.

How SixBySix approaches Adobe Commerce security updates

As we highlighted in our earlier analysis of APSB26-73, Adobe’s move towards monthly security releases means patching is increasingly becoming a regular operational activity. We have been developing tooling and processes to analyse the changes introduced by each release, identify the affected Magento modules and assess potential overlaps with bespoke implementations.

For APSB26-153, our technical review examined the isolated patch changes for Adobe Commerce 2.4.6-p15, including template processing, customer repositories, file handling and B2B authorisation.

Understanding what has changed beneath the surface helps us focus regression testing on the areas that matter rather than treating every patch as a generic deployment exercise. With critical vulnerabilities such as CVE-2026-103849, reducing the time between security disclosure and safe deployment is particularly important.

If you’re running Adobe Commerce or Magento Open Source and need support assessing or deploying APSB26-153, get in touch with the SixBySix team.

References

• Adobe Security Bulletin APSB26-153
• Adobe isolated patch guidance
• SixBySix – Previous APSB26-73 security analysis