Adobe has disclosed CVE-2026-92464, a critical (CVSS 9.1) improper input validation flaw in Adobe Commerce, Adobe Commerce B2B and Magento Open Source that a highly privileged attacker could use to execute arbitrary code.
What Is It
CVE-2026-92464 is an Improper Input Validation vulnerability (CWE-20). According to Adobe's description, it "could result in arbitrary code execution in the context of the current user." An attacker with high privileges could exploit it to run arbitrary code. Exploitation does not require user interaction, and the scope is changed.
Adobe PSIRT reported the CVE, and NVD published it on 2026-10-13. Its NVD status is currently "Awaiting Analysis."
Why It Matters
Adobe scored the flaw 9.1 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H:
- Network-exploitable with low attack complexity
- No user interaction required
- Scope changed, so the impact can extend beyond the vulnerable component
- High impact to confidentiality, integrity and availability
The main limit is that the attacker needs high privileges. A stolen admin credential or a malicious insider would meet that bar.
As of this writing, the supplied CISA KEV data has no entry for this CVE. KEV does not confirm active exploitation, and no KEV remediation deadline applies.
What's Vulnerable
According to the NVD record, these versions are affected:
Adobe Commerce: 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep and earlier
Adobe Commerce B2B: 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep and earlier
Magento Open Source: 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep and earlier
Patch Status
Adobe has published security bulletin APSB26-153. The NVD record lists these versions as unaffected:
- Adobe Commerce: 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-oct
- Adobe Commerce B2B: 1.5.4-alpha1, 1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, 1.3.3-2026-oct
- Magento Open Source: 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct
Administrators should read APSB26-153 and move to the matching October 2026 release for their branch. Because exploitation needs high privileges, it is also worth reviewing who holds admin-level access to Commerce instances.
Sources
- Adobe Security Bulletin APSB26-153
- NVD: CVE-2026-92464
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)