Multiple Vulnerabilities in Adobe Commerce / B2B & Magento Open Source - Unauthenticated Arbitrary Code Execution (RCE) & Authorization Bypass in the B2B Module
Adobe Commerce (formerly Magento Commerce) and its open-source edition, Magento Open Source, are widely used e-commerce platforms for building and operating online stores. The B2B module adds business-to-business sales capabilities such as company accounts and custom catalogs. CVE-2026-103849 An unauthenticated remote code execution vulnerability classified as CWE-1336 (Improper Neutralization of Special Elements). It allows arbitrary code execution on an affected installation without any authentication, user interaction, or privileges, and is rated 10.0 (critical) by Adobe's CNA. It was published in Adobe Security Bulletin APSB26-153 on October 13, 2026, which provides security fixes for Adobe Commerce / Magento Open Source versions 2.4.4 through 2.4.9 (October 2026 isolated security fixes) and for the 2.4.10 line. Adobe has not published technical details; no exploitation in the wild was known as of October 13, 2026. CVE-2026-92909 An Incorrect Authorization vulnerability (CWE-863) affecting the Adobe Commerce B2B module (versions 1.3.3 through 1.5.3 and earlier 2026 builds). Exploitation does not require authentication or user interaction and could result in arbitrary code execution in the context of the current user; it is rated 9.8 (critical) by the Adobe CNA. Stores without the B2B module are primarily exposed through CVE-2026-103849 instead. The vulnerability is fixed by the October 2026 update released with APSB26-153; no exploitation is known as of the publication date. Adobe additionally recommends applying the separate CVE-2026-75650 hotfix alongside the October isolated patch.
