September 2026 Magento Security Update:
What Adobe Commerce Merchants Need to Know

September 2026 is not a normal Magento security month. Adobe released two separate security bulletins within 24 hours for Adobe Commerce and Magento Open Source: an emergency Priority 1 update for CVE-2026-75650 on September 7, followed by the regularly scheduled September security update on September 8.

The distinction matters because the monthly September isolated patch does not include the CVE-2026-75650 hotfix. Adobe’s own September guidance tells merchants to apply the hotfix separately. For Adobe Commerce on Cloud, the fixes are also delivered through two different Cloud Patches for Commerce package releases.

What Adobe Released — and Why There Are Two Security Streams

APSB26-146 was published on September 7, 2026 with Adobe Commerce priority rating 1. It addresses CVE-2026-75650, an improper-neutralization flaw in a template engine that Adobe rates Critical, CVSS 10.0, requiring neither authentication nor user interaction for exploitation. Adobe says it is aware of exploitation in the wild.

On September 8, Adobe published APSB26-138, its scheduled September security update. Adobe says it resolves critical, important, and moderate vulnerabilities; its vulnerability table lists eight CVEs, each marked Critical. The bulletin covers Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. Adobe also explicitly warns that the CVE-2026-75650 hotfix must be applied in addition to the September security fixes.

CVE-2026-75650: The Emergency Magento / Adobe Commerce Hotfix

Adobe classifies CVE-2026-75650 as an improper neutralization of special elements used in a template engine (CWE-1336). The bulletin assigns a CVSS base score of 10.0, marks it Critical, and records that no authentication is required.

Independent research from Sansec reported exploitation beginning September 4, before Adobe’s September 7 hotfix. Akamai later confirmed active exploitation attempts and described a chain in which attacker-controlled data reaches Magento’s template-processing flow. Those independent findings reinforce Adobe’s “exploited in the wild” designation, but the Adobe bulletin remains the authoritative source for the affected product versions and official fix.

Adobe’s VULN-39341 hotfix matrix

Adobe’s September 21 Knowledge Base update expands the official hotfix compatibility for the 2.4.4–2.4.7 lines. Always use the package mapped to the exact installed version or patch level in Adobe’s current KB rather than copying a patch from another baseline.

The Full APSB26-138 Vulnerability List

The original draft is incomplete here. Adobe’s official bulletin lists eight CVEs, and two are specific to the Adobe Commerce B2B component.

Six of the eight CVEs in APSB26-138 are recorded by Adobe as exploitable without authentication. The two B2B-specific issues are CVE-2026-77109 and CVE-2026-77108. Adobe says it is not aware of exploitation in the wild for the issues addressed by APSB26-138.

Which Adobe Commerce and Magento Versions Are Affected?

For APSB26-146, Adobe lists Adobe Commerce 2.4.4 through 2.4.9 at the August 2026 release level and earlier, Adobe Commerce B2B 1.3.3 through 1.5.3 at the August 2026 level and earlier, and Magento Open Source 2.4.4 through 2.4.9 at the August 2026 level and earlier as affected.

For the regular September update APSB26-138, Adobe lists affected Adobe Commerce lines 2.4.4 through 2.4.9 and B2B 1.3.3 through 1.5.3. The fixed September versions are:

Adobe also lists B2B fixed versions 1.3.3-2026-sep through 1.5.3-2026-sep. For Magento Open Source, the September bulletin lists fixed versions 2.4.7-2026-sep, 2.4.8-2026-sep, and 2.4.9-2026-sep.

September’s Isolated Patches: Every Release-Line Download

Adobe classified the September 8 security fixes as isolated security fixes. These are narrowly scoped patch files rather than new Composer security packages. Adobe’s September KB provides one ZIP per supported Adobe Commerce release line:

The ZIP can contain separate patch files for installed components such as CE, EE, B2B, PageBuilder, and other modules. Adobe instructs merchants to apply the file that matches each installed component and then verify the resulting security state.

How Adobe’s New Monthly Isolated-Patch Model Changes Patching

Adobe’s new model is designed to shorten the time between vulnerability disclosure and targeted remediation. An isolated patch contains only the code needed to address specified vulnerabilities and is folded into the next full security patch release.

Adobe Commerce on Cloud: Two Cloud Patch Package Releases

For Adobe Commerce on Cloud infrastructure, Adobe distributes critical fixes through the Cloud Patches for Commerce package, which is a dependency of ECE-Tools.

Patch Is Not the Same as Remediation

The most important operational instruction in Adobe’s CVE-2026-75650 guidance goes beyond the code change itself: rotate the encryption key and the credentials that could have been encrypted or exposed using it.

Adobe explicitly calls out Admin passwords, REST/SOAP/GraphQL integration tokens, OAuth client secrets, payment-gateway API credentials, database credentials, SSH/deployment keys, and API credentials for shipping, tax, and other integrated services.

Adobe also makes an important distinction: rotating the encryption key alone does not invalidate credentials that may already have been exposed. The associated credentials must be rotated at their respective systems or providers.

What About a Store That May Already Have Been Exploited?

A successful patch closes the vulnerable code path; it does not prove that no attacker reached the system before the fix existed. Sansec reported exploitation beginning September 4, before Adobe released the September 7 hotfix, and recommends scanning for compromise rather than assuming a clean state from a patch status alone.

For an affected production environment, the incident question is therefore broader than “Did we install the patch?” Security teams should review application and infrastructure logs, unexpected admin activity, filesystem changes, cron or process anomalies, outbound connections, modified templates or CMS content, suspicious integration credentials, and signs of persistence.

What Every Magento / Adobe Commerce Merchant Should Do Now

One More Adobe Commerce Cloud Consideration

Adobe has also published a separate security-enforcement policy for Adobe Commerce on Cloud PaaS environments running 2.4.4 through 2.4.9. That policy is distinct from the September CVE patches, but it matters for merchants maintaining older Cloud environments.

Adobe says 2.4.4/2.4.5 Cloud environments have a June 1, 2027 deadline to upgrade to a supported Commerce version or migrate to Adobe Commerce as a Cloud Service, while 2.4.6/2.4.7 have a June 1, 2028 deadline. Adobe also lists separate third-party dependency deadlines beginning October 30, 2026 for certain unsupported MariaDB, Elasticsearch/OpenSearch, and RabbitMQ configurations.

Final Takeaway

The right way to read Adobe’s September 2026 security releases is not “Adobe released a September patch.” Adobe released two separate security streams.

APSB26-146 is the emergency Priority 1 response to the actively exploited CVE-2026-75650, fixed through the VULN-39341 hotfix. APSB26-138 is the scheduled September security update covering eight CVEs, with version-specific isolated patch files for supported release lines.

The September isolated patch does not include CVE-2026-75650. Adobe also recommends encryption-key and credential rotation as part of full remediation for the critical RCE. For Cloud merchants, the corresponding fixes are delivered through Cloud Patches for Commerce v1.1.20 and v1.1.21.