What it is
In Adobe’s words, the flaw is an “Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution.” Put simply: the store accepts a file it should refuse, and that file can then run as code. Adobe notes the attack needs a person to visit a crafted link or a compromised page, which on a busy store is a low bar.
Adobe published the fix on July 14, 2026 in bulletin APSB26-73. The reason it matters again now is that CISA added it to its exploited list on October 27, so this has moved from “a patch you should install” to “a patch attackers are checking for.”
Which stores are affected
- Magento Open Source 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 and every earlier release in those lines.
- Adobe Commerce 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 and earlier, plus Adobe Commerce B2B 1.5.3 and earlier.
- Adobe Commerce Events 1.20.0 and earlier (fixed in 1.21.0).
- Release lines missing from Adobe’s fixed list (Magento Open Source before 2.4.6, Adobe Commerce before 2.4.4) have no listed fix. If your store is that far behind, the patch question is really a replatform question.
What to do
- Find your versionYour developer or host can tell you in a minute. In the admin, the version shows at the bottom of every page.
- Install the July 2026 patchThe fixed builds carry “2026-jul” in the version (for example 2.4.8-2026-jul). Patch a copy of the store first if you can, then the live store.
- Look for signs it already happenedThe flaw was exploited before many stores patched. Ask whoever runs the server to check for files in the media and upload folders that shouldn’t be there, and for admin accounts nobody recognizes.
- If nobody maintains the storeThat’s the real risk. A Magento store needs someone applying Adobe’s patches every quarter, or it should move to a platform that patches itself.
We build and look after online stores that don’t depend on quarterly patch cycles. If you’d like a second opinion on yours, tell us about it.
Sources
Written by Nikita Huttenlocher, founder and lead engineer at Huttenlocher Technologies, a cybersecurity and software firm in Myrtle Beach, South Carolina. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.