APSB26-138: Magento Security Update September 2026 What to Do

In September 2026, Adobe published two distinct security upgrades for Adobe Commerce and Magento. The updates are not the same. Both of them need to be used. Additionally, they must be used in the proper sequence.

Many developers and retail owners have applied one and stopped because they thought they were covered. They’re not. This document provides a detailed explanation of both upgrades, who is impacted, and what to do.

You must take two actions if you use any version of Adobe Commerce or Magento 2:

1. If you haven’t already, apply the urgent StyleSmuggler update VULN-39341 (APSB26-146).
2. Use the APSB26-138 security upgrade from September 2026 independently.

These are two different releases. The StyleSmuggler hotfix is not included in APSB26-138. What APSB26-138 fixes is not covered by the StyleSmuggler hotfix. Adobe makes it clear that both need to be used.

The section below explains how to check if you’re not sure which you applied for.

Many merchants responded to one update while missing the other, so it’s important to understand the sequence of events.

September 4, 2026 A previously undiscovered vulnerability in Magento’s email template system was found to be actively exploited by Sansec, a Magento security company. It was given the name StyleSmuggler. At the time, it was effective against stores that were fully patched. As of yet, there was no official solution.

On September 7, 2026 Adobe issued APSB26-146, an emergency out-of-band advisory, with the highest rating of Priority 1. The patch was released as VULN-39341, a composer-level hotfix. Additionally, Adobe added CVE-2026-75650 to monitor this vulnerability, which has the highest potential severity of a CVSS score of 10.0. On the same day, CISA added CVE-2026-75650 to its list of known exploited vulnerabilities.

On September 8, 2026 Adobe published APSB26-138, its regularly scheduled September security update, at Priority 2. Eight more vulnerabilities are addressed in this separate bulletin, including two stored cross-site scripting weaknesses rated 9.3 that can be exploited without authentication. The VULN-39341 patch must be used in combination with the September update, not in place of it, according to Adobe’s release notes.

On September 16, 2026 Adobe added more information on the connection between the two releases to the Experience League knowledge base entry for APSB26-138.

StyleSmuggler is the more urgent of the two issues and should have been applied first, ahead of APSB26-138.

What it is: An unauthenticated remote code execution vulnerability. An attacker with no credentials, no Magento account, and no admin access can execute arbitrary code on your server by exploiting how Magento processes certain email template directives. It affects all Magento Open Source and Adobe Commerce versions from 2.4.4 through 2.4.9.

When it was exploited: From 4 September 2026, before any official patch existed. Stores that had not applied the hotfix by their patching date were exposed for a measurable window of active real-world exploitation.

What attackers can do with it: Execute code on your server, install backdoors, access customer data, access payment credentials, and persist access after you think you have cleaned the infection. Foregenix’s forensic team notes that the vulnerability’s attack surface reaches payment gateway API credentials, database access credentials, and Magento encryption key material.

The fix: Hotfix VULN-39341 from Adobe, distributed as VULN-39341-composer-patches.zip. Download from repo.magento.com. Apply as a composer patch. Verify with:

vendor/bin/magento-patches -n status | grep “39341\|Status”

You want to see Applied in the output. If you do not see Applied, the hotfix has not been correctly installed.

If you cannot patch immediately: Adobe’s guidance and the security community recommend blocking /graphql as a temporary mitigation until the hotfix can be applied. This is a workaround only it does not fully remediate the risk and should not be treated as a substitute for patching.

APSB26-138 is Adobe’s regularly scheduled September security bulletin. It addresses eight vulnerabilities that are entirely separate from StyleSmuggler. Applying the StyleSmuggler hotfix does not cover these. They require the September isolated patch files or the September security builds.

Priority rating: 2 (Adobe’s second-highest rating). Adobe reports no known active exploitation for these vulnerabilities at this time.

The Eight Vulnerabilities in APSB26-138

CVE-2026-76200 and CVE-2026-76201 are the two most urgent vulnerabilities. Both have a 9.3 rating for XSS stored cross-site scripting and may be exploited without authentication. This implies that an attacker without an account can introduce a malicious script into your Magento database. The script runs and increases the attacker’s access when an admin user views the impacted content section. Because “no known exploits” refers to what Adobe has seen rather than what attackers could be working on, this class of vulnerability is dangerous even in the absence of known exploits in the wild.

B2B-specific are CVE-2026-77109 and CVE-2026-77108. These two CVEs do not directly affect Magento Open Source stores that do not have the Adobe Commerce B2B module installed. The remaining CVEs are applicable to both Adobe Commerce and Magento Open Source.

APSB26-138 affects these product versions:

• Adobe Commerce: 2.4.4 through 2.4.9 (all release lines)
• Adobe Commerce B2B: 1.3.3 through 1.5.3 (all release lines)
• Magento Open Source: 2.4.7, 2.4.8, and 2.4.9

Magento versions that have passed end-of-support (2.4.4 and earlier except through the 2.4.5-p17 line) are not receiving patches. If your store runs an unsupported version, you are exposed to all vulnerabilities above with no official path to remediation short of upgrading.

Apply these in order. Do not reverse the sequence. Do not skip the hotfix assuming the September update covers it.

Step 1 Apply the StyleSmuggler hotfix (VULN-39341)

Download VULN-39341-composer-patches.zip from repo.magento.com. Apply via Composer. Verify:

vendor/bin/magento-patches -n status | grep “39341\|Status”

Confirm the status shows Applied.

Step 2 Apply the September APSB26-138 isolated patch for your version

From the Adobe Experience League knowledge base article for APSB26-138, download the isolated patch file for your exact release line:

• Magento 2.4.9: 2-4-9-sep-2026.zip
• Magento 2.4.5: Update to 2.4.5-p17 first, apply the July & August isolated patches, then apply the September patch

Before applying, ensure you have already applied the matching July and August 2026 isolated patches for your version. The September patch depends on them.

Step 3 Verify both patches are applied

Run:

php vendor/bin/patch-status

Confirm the September CVE set shows PROTECTED.

Step 4 Flush cache and test

bin/magento cache:flush

Test your storefront, checkout, and admin panel before closing the maintenance window.

Patching prevents exploitation in the future. A store that has previously been compromised is not cleaned by it.

You should do compromise checks before believing you are clean if your shop was operating without the VULN-39341 hotfix between September 4, 2026, and the date of your patch application. Patch-only solutions are inadequate when active exploitation has taken place, according to the security community, which includes Sansec, SwissUpLabs, and Foregenix.

Check for signs of compromise:

• Look for unexpected PHP files in pub/media/catalog/product/cache/

find pub/media -name ‘*.php’

• Check for unexpected processes running on the server, particularly [kworker/u:8:0], fc-cache, or chronyd running in unusual contexts
• Review Magento admin logs and access logs for unusual admin user creation or API token generation between 4 September and your patch date
• Check your cron spool for payloads running from /tmp/ or other unexpected directories

Credential rotation required, not optional:

Adobe’s guidance is explicit: rotating the encryption key alone does not invalidate already-exposed credentials. If you have reason to believe your store was exploited before patching, rotate all of the following at source:

1. Magento encryption key (Admin > System > Manage Encryption Key)
2. All admin user passwords
3. All API integration tokens (REST, SOAP, GraphQL)
4. OAuth client secrets
5. Payment gateway API credentials at the gateway provider level (Stripe dashboard, PayPal developer account, Braintree), not just inside Magento
6. Database access credentials
7. SSH keys and deployment credentials

Rotating the Magento encryption key alone without rotating the credentials that key protected leaves exposed credentials in place. Each credential must be rotated at its source.

If you find evidence of a backdoor, preserve evidence before deleting anything. Wipe and rebuild from a known-good source revision rather than attempting to clean in place.

Mage-OS released version 3.5.0 on 8 September 2026 as an emergency security release. It includes the StyleSmuggler hotfix, the September APSB26-138 isolated patches, and additional hardening around the same attack surface.

Upgrade to 3.5.0 immediately:

composer require mage-os/product-community-edition 3.5.0 –no-update

composer update

The remediation cannot be finished by upgrading alone. Before the patch, stores could be exploited for three days. Examine the Mage-OS 3.5.0 release notes; these include measures for credential rotation and compromise assessment, which both Adobe and Sansec believe are necessary rather than optional.

Cloud-patches provide security updates for users of Adobe Commerce Cloud. Run the following to see if the September 2026 cloud patches update already includes the necessary fixes:

vendor/bin/magento-patches -n status

For the StyleSmuggler hotfix specifically, confirm VULN-39341 shows Applied. Cloud deployments may have received the APSB26-138 updates automatically depending on your configuration, but the VULN-39341 hotfix must be separately verified.

The Adobe Commerce Certified team at KiwiCommerce can help if you’re not sure if your business has been properly patched or if you need assistance evaluating any compromise.

Our Magento Support Services cover security patch application, version audits, and post-incident compromise checks for UK merchants on Magento and Adobe Commerce. If your store needs a security audit before or after applying these patches, our Magento Code Audit service covers a full review of your current security posture, configuration, and code.

For stores that are running on older, unsupported Magento versions and cannot receive official patches, our Magento Development Services team can assess the upgrade path, whether that is an upgrade to a supported Magento version, a migration to Shopify, or another appropriate route for your specific situation. Our Hire Magento Developers and Hire Adobe Commerce Developers pages cover options for bringing in dedicated resource if your internal team needs capacity. Get in touch with the KiwiCommerce team if you need help with these security updates.

Security fixes must be installed in the proper sequence, tested in staging prior to production, and confirmed following deployment. The KiwiCommerce team can assist if your team requires assistance with this or if you are worried that your store might have been compromised prior to updating.

• Two separate updates were released in September 2026 they are NOT interchangeable and both must be applied
• APSB26-146 (hotfix VULN-39341): addresses StyleSmuggler, CVE-2026-75650, CVSS 10.0, actively exploited since 4 September 2026
• APSB26-138: eight additional CVEs including two unauthenticated stored XSS rated 9.3 addressed separately, not bundled with the hotfix
• Apply VULN-39341 first, then APSB26-138, then verify both with vendor/bin/magento-patches -n status
• CVE-2026-77109 and CVE-2026-77108 are B2B-specific; Magento Open Source without B2B is not affected by those two
• Stores exposed to StyleSmuggler before patching must carry out compromise checks and full credential rotation patching alone is insufficient
• Rotating the Magento encryption key alone does not cover the credentials that key protects rotate each at source