APSB25-26: Adobe Commerce and Magento Open Source Critical Security Update Released

nteriaca2025-04-28T08:23:33-04:00Categories: Adobe Commerce, Magento|Tags: Magento Open Source, Adobe Security Update, Adobe Security Bulletin, Critical Security Update, Adobe Commerce, Adobe Commerce 2.4.7, Adobe Commerce 2.4.8, Adobe patch, APSB25-26, Magento vulnerabilities|

APSB25-26: Adobe Commerce and Magento Open Source Critical Security Update Released

Adobe has recently released a critical security update for its Adobe Commerce and Magento Open Source platforms. This blog post aims to cover the specifics of this update, the possible risks it minimizes, and actionable steps users can take to strengthen their security posture.

The security update, APSB25-26, was released on April 8, 2025. It addresses critical vulnerabilities present in Adobe Commerce and Magento Open Source. These vulnerabilities, if exploited, could lead to security feature bypass, privilege escalation, and application denial-of-service.

Affected Versions

The affected versions include various iterations of Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. Users of versions before the following are urged to take immediate action:

Adobe Commerce: 2.4.8-beta2, 2.4.7-p4 and earlier, 2.4.6-p9 and earlier, 2.4.5-p11 and earlier, 2.4.4-p12 and earlier and more
Adobe Commerce B2B: 1.5.1 and earlier, 1.4.2-p4 and earlier, 1.3.5-p9 and earlier, 1.3.4-p11 and earlier, 1.3.3-p12 and earlier, and more.
Magento Open Source: 2.4.8-beta2, 2.4.7-p4 and earlier, 2.4.6-p9 and earlier, 2.4.5-p11 and earlier, 2.4.4-p12 and earlier, and more.

Solution

Adobe has provided updated versions for both Adobe Commerce and Magento Open Source to address these vulnerabilities. Adobe has categorized the updates with the priority ratings and users are strongly advised to update their installations to the newest versions as soon as possible. Detailed installation instructions are available on Adobe’s website.

Vulnerability Details

The vulnerabilities encompass various categories, including Improper Limitation of a Pathname to improper authorization (CWE-285), Cross-Site Request Forgery (CSRF) (CWE-352), Improper Access Control (CWE-284), Improper Access Control (CWE-284), and Insufficiently Protected Credentials (CWE-522). These vulnerabilities pose the risk of security feature bypass, privilege escalation, and application denial-of-service.

You can find detailed information here: Adobe Security Bulletin APSB25-26.