APSB26-73: Understanding Adobe Commerce latest security update

Earlier this year, Adobe announced a new release schedule for Adobe Commerce, introducing a more predictable cadence for security and quality updates. That’s a positive step for the Adobe Commerce/ Magento 2 ecosystem, but it also means security updates are becoming a regular operational activity rather than an occasional maintenance exercise. Over the past few months, we’ve been adapting our own processes to match that change.

Instead of treating every security release as a manual exercise, we’ve been building tooling to analyse Adobe’s patch sets, identify exactly which Magento modules have changed, compare those changes against our clients’ bespoke code, and generate targeted regression testing plans.

The objective is simple: reduce the time between Adobe publishing a security update and our clients being able to deploy it safely and confidently.

The latest example came on 14 July, when Adobe released APSB26-73, introducing isolated security patches for Adobe Commerce, Adobe Commerce B2B, Magento Open Source and Adobe Commerce Events. Adobe’s security bulletins tell you what has been fixed, but rarely how.

Technical Insights

For every release, we reverse-engineer the patch set to understand:

• Which Magento modules have changed.
• Which CVEs map to which areas of the codebase.
• How the vulnerabilities could realistically be exploited.
• Where bespoke modules or theme overrides may overlap with patched functionality.
• Which areas of the application require targeted regression testing.

For APSB26-73, that analysis covered changes across Quote, Catalog, Framework, Translation, Customer, Store and several Adobe Commerce B2B modules.

• One of the more interesting fixes closes an authorisation gap in guest checkout. Prior to the patch, certain guest checkout endpoints could resolve a masked cart ID before confirming the underlying quote still belonged to a guest. The update introduces an additional validation step, ensuring guest APIs can no longer operate on quotes that have since become associated with a customer account.
• The release also contains a number of improvements to Magento’s XSS protections, strengthening client-side template handling, improving sanitisation within the admin interface and hardening several Adobe Commerce B2B administration screens.
• Another area that caught our attention was media upload security. APSB26-73 introduces additional defence-in-depth measures that closely mirror the mitigations introduced following the PolyShell vulnerability. While Adobe’s initial response was focused on Magento 2.4.9, this appears to be the first security release to backport those protections across the supported release branches, strengthening upload validation, expanding protected file extensions and reducing the risk of dangerous files being exposed publicly.

For us, applying a security patch is only part of the process. Understanding why the code changed allows us to focus testing where it matters most, identify bespoke code that may override patched behaviour, and give our clients confidence that security updates have been deployed without introducing regressions.

As Adobe continues its new release cadence, we’ll continue investing in the tooling and processes that help our clients stay secure while reducing the time, effort and risk involved in adopting each new release.