Security update available for Adobe Commerce | APSB26-73

BlackTree keeps a versioned source snapshot and links it to relevant CVE reports. The publisher remains authoritative for product applicability, release details and installation guidance.

Read the official article ↗

PublisherAdobe

Article IDAPSB26-73

Verified snapshot22 Oct 2026, 20:52 UTC

Linked CVEs14

Linked CVE reports

These are source relationships, not a claim that this article fixes every affected product or branch.

CVE-2026-48356Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
CVE-2026-47988Adobe Commerce | Incorrect Authorization (CWE-863)
CVE-2026-47994Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-48371Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-47995Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-47999Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-47992Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
CVE-2026-48000Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
CVE-2026-47998Adobe Commerce | Incorrect Authorization (CWE-863)
CVE-2026-48358Adobe Commerce | Improper Encoding or Escaping of Output (CWE-116)
CVE-2026-47997Adobe Commerce | Incorrect Authorization (CWE-863)
CVE-2026-47984Adobe Commerce | Incorrect Authorization (CWE-863)
CVE-2026-47996Adobe Commerce | Incorrect Authorization (CWE-863)
CVE-2026-48001Adobe Commerce | Information Exposure (CWE-200)

Source and provenance

Original title: Security update available for Adobe Commerce | APSB26-73. Captured 22 Oct 2026, 20:52 UTC. The stored article is used for enrichment and change detection; BlackTree does not republish the publisher's full text here.

Open the publisher's current version ↗