Security update available for Adobe Commerce | APSB26-49

BlackTree keeps a versioned source snapshot and links it to relevant CVE reports. The publisher remains authoritative for product applicability, release details and installation guidance.

Read the official article ↗

PublisherAdobe

Article IDAPSB26-49

Verified snapshot23 Oct 2026, 04:00 UTC

Linked CVEs15

Linked CVE reports

These are source relationships, not a claim that this article fixes every affected product or branch.

CVE-2026-34645Adobe Commerce | Incorrect Authorization (CWE-863)
CVE-2026-34650Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)
CVE-2026-34647Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)
CVE-2026-34649Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)
CVE-2026-34648Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)
CVE-2026-34652Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395)
CVE-2026-34651Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)
CVE-2026-34685Adobe Commerce | Improper Input Validation (CWE-20)
CVE-2026-34686Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-34658Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-34654Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395)
CVE-2026-34653Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
CVE-2026-34656Adobe Commerce | Improper Authorization (CWE-285)
CVE-2026-34655Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-34646Adobe Commerce | Incorrect Authorization (CWE-863)

Source and provenance

Original title: Security update available for Adobe Commerce | APSB26-49. Captured 23 Oct 2026, 04:00 UTC. The stored article is used for enrichment and change detection; BlackTree does not republish the publisher's full text here.

Open the publisher's current version ↗