Adobe Commerce security bulletin APSB26-05 — March 2026 patch breakdown

Adobe released APSB26-05 on March 10, 2026 — the Q1 2026 scheduled security bulletin for Adobe Commerce and Magento Open Source. It addresses critical vulnerabilities that could allow privilege escalation, arbitrary code execution, and file system access on unpatched stores.

What APSB26-05 addresses

The vulnerabilities in this bulletin, if exploited, could allow an attacker to:

• Bypass security controls — circumventing authentication or access checks
• Escalate privileges — gaining higher-level access than intended
• Execute arbitrary code — running attacker-controlled code on your server
• Read arbitrary files — accessing files outside the web root
• Trigger denial of service — taking the storefront or admin offline

The severity ratings reach critical. Adobe’s standard language applies — no confirmed active exploitation at time of release — but historical pattern with Magento bulletins is that proof-of-concept exploits appear within days of publication. Treat this as urgent.

Affected versions

Product	Affected
Adobe Commerce	2.4.8-p3 and earlier, 2.4.7-p8 and earlier, 2.4.6-p13 and earlier, 2.4.5-p15 and earlier, 2.4.4-p16 and earlier
Adobe Commerce B2B	1.5.2-p3 and earlier, 1.4.2-p8 and earlier, 1.3.5-p13 and earlier, 1.3.4-p15 and earlier, 1.3.3-p16 and earlier
Magento Open Source	2.4.8-p3 and earlier, 2.4.7-p8 and earlier, 2.4.6-p13 and earlier, 2.4.5-p15 and earlier

Fixed versions

Product	Apply this version
Adobe Commerce	2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17
Adobe Commerce B2B	1.5.2-p4, 1.4.2-p9, 1.3.5-p14, 1.3.4-p16, 1.3.3-p17
Magento Open Source	2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16

Apply the patch version that corresponds to your current release line. These are security-only patches — they don’t change framework dependencies or require PHP version changes.

Security patches vs full upgrades

A recurring question from merchants: should I apply the targeted security patch or use this as an opportunity to do a full upgrade?

The honest answer depends on your situation:

Apply the security patch if: Your extension compatibility is uncertain, you’re in a code freeze period, or you’re within 4–6 weeks of a scheduled maintenance window. The security patch gets you covered without the risk surface of a full upgrade.

Do the full upgrade if: You’re multiple release lines behind (still on 2.4.5 or older), your extensions are confirmed compatible, and you have capacity. Staying on older release lines means each new bulletin requires another targeted patch — you’re accumulating maintenance debt. At some point, upgrading is less work than patching in place indefinitely.

For context: 2.4.4 reaches end of life in April 2026. If you’re on 2.4.4, this patch (2.4.4-p17) is likely the last security patch you’ll receive. Plan accordingly.

Applying the patch

# Replace X.X.X-pY with your target version
composer require magento/product-community-edition 2.4.7-p9 --no-update
composer update magento/product-community-edition

bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento setup:static-content:deploy -f
bin/magento cache:flush

Run this against staging first. Security patches occasionally touch payment and checkout-adjacent code — verify your critical user journeys before deploying to production.

If you’re on Adobe Commerce Cloud, apply patches via the ece-tools patch mechanism rather than directly via Composer. The process is the same conceptually but the tooling differs — check your project’s deployment documentation.

If your version is end-of-life

Versions older than 2.4.4 receive no patches for APSB26-05 or any future bulletins. If you’re still on 2.4.3 or older, you’re not getting this fix. The only path to coverage is a version upgrade — there’s no targeted patch available for EOL release lines.

This isn’t an abstraction: an unpatched EOL Magento store is an active liability. The vulnerabilities are public, the store isn’t getting fixes, and attackers scan for known-vulnerable Magento versions routinely.

Official bulletin: Adobe APSB26-05