Security update available for Adobe Commerce | APSB26-73
摘要
Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves critical , important and moderate vulnerabilities. Successful exploitation could lead to arbitrary code execution, privilege escalation, and security feature bypass.
正文
Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves critical , important and moderate vulnerabilities. Successful exploitation could lead to arbitrary code execution, privilege escalation, and security feature bypass. Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates. Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version. Solutions: - Adobe Commerce | 2.4.9-2026-jul 2.4.8-2026-jul 2.4.7-2026-jul 2.4.6-2026-jul 2.4.5-2026-jul 2.4.4-2026-jul | All (Priority 2; Release Notes) - Adobe Commerce B2B | 1.5.3-2026-jul 1.5.2-2026-jul 1.4.2-2026-jul 1.3.4-2026-jul 1.3.3-2026-jul | All (Priority 2; Release Notes) - Magento Open Source | 2.4.9-2026-jul 2.4.8-2026-jul 2.4.7-2026-jul 2.4.6-2026-jul | All (Priority 2; Release Notes) - Adobe Commerce Events | 1.21.0 | All (Priority 2; Upgrade Modules and Extensions) Authentication required to exploit: The vulnerability is (or is not) exploitable without credentials. Exploit requires admin privileges: The vulnerability is (or is not) only exploitable by an attacker with administrative privileges. Vulnerabilities: - Unrestricted Upload of File with Dangerous Type ( CWE-434 ) | Privilege escalation | Critical | CVSS 9.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L - Improper Encoding or Escaping of Output ( CWE-116 ) | Arbitrary code execution | Critical | CVSS 9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Cross-site Scripting (Stored XSS) ( CWE-79 ) | Privilege escalation | Critical | CVSS 8.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N - Incorrect Authorization ( CWE-863 ) | Security feature bypass | Critical | CVSS 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Incorrect Authorization ( CWE-863 ) | Security feature bypass | Critical | CVSS 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Cross-site Scripting (Stored XSS) ( CWE-79 ) | Privilege escalation | Critical | CVSS 8.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N - Incorrect Authorization ( CWE-863 ) | Security feature bypass | Critical | CVSS 7.6 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L - Improper Input Validation ( CWE-20 ) | Privilege escalation | Critical | CVSS 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Incorrect Authorization ( CWE-863 ) | Security feature bypass | Important | CVSS 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Incorrect Authorization ( CWE-863 ) | Security feature bypass | Important | CVSS 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Cross-site Scripting (Stored XSS) ( CWE-79 ) | Arbitrary code execution | Important | CVSS 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Cross-site Scripting (Stored XSS) ( CWE-79 ) | Arbitrary code execution | Important | CVSS 4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - URL Redirection to Untrusted Site ('Open Redirect') ( CWE-601 ) | Security feature bypass | Moderate | CVSS 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Information Exposure ( CWE-200 ) | Security feature bypass | Moderate | CVSS 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Acknowledgment: Adobe would like to thank the following researchers for reporting these issues and working with Adobe to help protect our customers: Acknowledgment: 0x0.eth - CVE-2026-47984, CVE-2026-47996 Acknowledgment: T.H. Lassche - CVE-2026-47988 Acknowledgment: Sudhanshu Rajbhar (sudi) - CVE-2026-47992 Acknowledgment: wohlie - CVE-2026-47994, CVE-2026-47995, CVE-2026-48358 Acknowledgment: akashhamal0x01 - CVE-2026-47997, CVE-2026-47998, CVE-2026-48001 Acknowledgment: s (howtoplay) - CVE-2026-47999 Acknowledgment: schemonah - CVE-2026-48000 Acknowledgment: Tseng, Ching-Yen (shaber) - CVE-2026-48371 Acknowledgment: NOTE: Adobe has a public bug bounty program with HackerOne. If you are interested in working with Adobe as an external security researcher, please check out https://hackerone.com/adobe . Acknowledgment: For more information, visit https://helpx.adobe.com/security.html , or email [email protected].
标签
- contains:cve
- priority:2
- vendor:adobe
扩展字段
{
"acknowledgments": [
"Adobe would like to thank the following researchers for reporting these issues and working with Adobe to help protect our customers:",
"0x0.eth - CVE-2026-47984, CVE-2026-47996",
"T.H. Lassche - CVE-2026-47988",
"Sudhanshu Rajbhar (sudi) - CVE-2026-47992",
"wohlie - CVE-2026-47994, CVE-2026-47995, CVE-2026-48358",
"akashhamal0x01 - CVE-2026-47997, CVE-2026-47998, CVE-2026-48001",
"s (howtoplay) - CVE-2026-47999",
"schemonah - CVE-2026-48000",
"Tseng, Ching-Yen (shaber) - CVE-2026-48371",
"NOTE: Adobe has a public bug bounty program with HackerOne. If you are interested in working with Adobe as an external security researcher, please check out https://hackerone.com/adobe .",
"For more information, visit https://helpx.adobe.com/security.html , or email [email protected]."
],
"bulletin_id": "APSB26-73",
"detail_url": "https://helpx.adobe.com/security/products/magento/apsb26-73.html",
"last_updated": "07/14/2026",
"originally_posted": "07/14/2026",
"priority": "2",
"solution_paragraphs": [
"Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version."
],
"solutions": [
{
"availability": "Release Notes",
"availability_url": "https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-37421",
"platform": "All",
"priority": "2",
"product": "Adobe Commerce",
"version": "2.4.9-2026-jul 2.4.8-2026-jul 2.4.7-2026-jul 2.4.6-2026-jul 2.4.5-2026-jul 2.4.4-2026-jul"
},
{
"availability": "Release Notes",
"availability_url": "https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-37421",
"platform": "All",
"priority": "2",
"product": "Adobe Commerce B2B",
"version": "1.5.3-2026-jul 1.5.2-2026-jul 1.4.2-2026-jul 1.3.4-2026-jul 1.3.3-2026-jul"
},
{
"availability": "Release Notes",
"availability_url": "https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-37421",
"platform": "All",
"priority": "2",
"product": "Magento Open Source",
"version": "2.4.9-2026-jul 2.4.8-2026-jul 2.4.7-2026-jul 2.4.6-2026-jul"
},
{
"availability": "Upgrade Modules and Extensions",
"availability_url": "https://experienceleague.adobe.com/en/docs/commerce-operations/upgrade-guide/modules/upgrade",
"platform": "All",
"priority": "2",
"product": "Adobe Commerce Events",
"version": "1.21.0"
}
],
"summary_paragraphs": [
"Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves critical , important and moderate vulnerabilities. Successful exploitation could lead to arbitrary code execution, privilege escalation, and security feature bypass.",
"Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates."
],
"vulnerabilities": [
{
"Authentication required to exploit?": "No",
"CVE number(s)": "CVE-2026-48356",
"CVSS base score": "9.6",
"CVSS vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L",
"Exploit requires admin privileges?": "No",
"Notes": null,
"Severity": "Critical",
"Vulnerability Category": "Unrestricted Upload of File with Dangerous Type ( CWE-434 )",
"Vulnerability Impact": "Privilege escalation"
},
{
"Authentication required to exploit?": "Yes",
"CVE number(s)": "CVE-2026-48358",
"CVSS base score": "9.1",
"CVSS vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"Exploit requires admin privileges?": "Yes",
"Notes": "Applies to webhooks only",
"Severity": "Critical",
"Vulnerability Category": "Improper Encoding or Escaping of Output ( CWE-116 )",
"Vulnerability Impact": "Arbitrary code execution"
},
{
"Authentication required to exploit?": "Yes",
"CVE number(s)": "CVE-2026-47994",
"CVSS base score": "8.7",
"CVSS vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"Exploit requires admin privileges?": "Yes",
"Notes": null,
"Severity": "Critical",
"Vulnerability Category": "Cross-site Scripting (Stored XSS) ( CWE-79 )",
"Vulnerability Impact": "Privilege escalation"
},
{
"Authentication required to exploit?": "No",
"CVE number(s)": "CVE-2026-47988",
"CVSS base score": "8.6",
"CVSS vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"Exploit requires admin privileges?": "No",
"Notes": null,
"Severity": "Critical",
"Vulnerability Category": "Incorrect Authorization ( CWE-863 )",
"Vulnerability Impact": "Security feature bypass"
},
{
"Authentication required to exploit?": "No",
"CVE number(s)": "CVE-2026-47984",
"CVSS base score": "8.2",
"CVSS vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"Exploit requires admin privileges?": "No",
"Notes": null,
"Severity": "Critical",
"Vulnerability Category": "Incorrect Authorization ( CWE-863 )",
"Vulnerability Impact": "Security feature bypass"
},
{
"Authentication required to exploit?": "Yes",
"CVE number(s)": "CVE-2026-47995",
"CVSS base score": "8.1",
"CVSS vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N",
"Exploit requires admin privileges?": "Yes",
"Notes": "B2B",
"Severity": "Critical",
"Vulnerability Category": "Cross-site Scripting (Stored XSS) ( CWE-79 )",
"Vulnerability Impact": "Privilege escalation"
},
{
"Authentication required to exploit?": "Yes",
"CVE number(s)": "CVE-2026-47996",
"CVSS base score": "7.6",
"CVSS vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L",
"Exploit requires admin privileges?": "Yes",
"Notes": null,
"Severity": "Critical",
"Vulnerability Category": "Incorrect Authorization ( CWE-863 )",
"Vulnerability Impact": "Security feature bypass"
},
{
"Authentication required to exploit?": "Yes",
"CVE number(s)": "CVE-2026-47992",
"CVSS base score": "7.2",
"CVSS vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"Exploit requires admin privileges?": "Yes",
"Notes": null,
"Severity": "Critical",
"Vulnerability Category": "Improper Input Validation ( CWE-20 )",
"Vulnerability Impact": "Privilege escalation"
},
{
"Authentication required to exploit?": "No",
"CVE number(s)": "CVE-2026-47997",
"CVSS base score": "5.9",
"CVSS vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"Exploit requires admin privileges?": "No",
"Notes": null,
"Severity": "Important",
"Vulnerability Category": "Incorrect Authorization ( CWE-863 )",
"Vulnerability Impact": "Security feature bypass"
},
{
"Authentication required to exploit?": "No",
"CVE number(s)": "CVE-2026-47998",
"CVSS base score": "5.9",
"CVSS vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"Exploit requires admin privileges?": "No",
"Notes": null,
"Severity": "Important",
"Vulnerability Category": "Incorrect Authorization ( CWE-863 )",
"Vulnerability Impact": "Security feature bypass"
},
{
"Authentication required to exploit?": "Yes",
"CVE number(s)": "CVE-2026-48371",
"CVSS base score": "5.4",
"CVSS vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"Exploit requires admin privileges?": "Yes",
"Notes": null,
"Severity": "Important",
"Vulnerability Category": "Cross-site Scripting (Stored XSS) ( CWE-79 )",
"Vulnerability Impact": "Arbitrary code execution"
},
{
"Authentication required to exploit?": "Yes",
"CVE number(s)": "CVE-2026-47999",
"CVSS base score": "4.8",
"CVSS vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"Exploit requires admin privileges?": "Yes",
"Notes": null,
"Severity": "Important",
"Vulnerability Category": "Cross-site Scripting (Stored XSS) ( CWE-79 )",
"Vulnerability Impact": "Arbitrary code execution"
},
{
"Authentication required to exploit?": "Yes",
"CVE number(s)": "CVE-2026-48000",
"CVSS base score": "4.3",
"CVSS vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"Exploit requires admin privileges?": "Yes",
"Notes": null,
"Severity": "Moderate",
"Vulnerability Category": "URL Redirection to Untrusted Site ('Open Redirect') ( CWE-601 )",
"Vulnerability Impact": "Security feature bypass"
},
{
"Authentication required to exploit?": "No",
"CVE number(s)": "CVE-2026-48001",
"CVSS base score": "3.7",
"CVSS vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"Exploit requires admin privileges?": "No",
"Notes": null,
"Severity": "Moderate",
"Vulnerability Category": "Information Exposure ( CWE-200 )",
"Vulnerability Impact": "Security feature bypass"
}
],
"vulnerability_paragraphs": [
"Authentication required to exploit: The vulnerability is (or is not) exploitable without credentials.",
"Exploit requires admin privileges: The vulnerability is (or is not) only exploitable by an attacker with administrative privileges."
]
}