John Cuthbert 
A day after the emergency StyleSmuggler hotfix, Adobe released its regular monthly security bulletin for September 2026 — APSB26-138. It’s easy to assume patching to the September release handles everything, including StyleSmuggler. It doesn’t. If you haven’t read our StyleSmuggler advisory yet, that’s the more urgent one — this post covers the separate, routine patch cycle.
What’s In This Patch?
APSB26-138 fixes 8 CVEs. Every single one is rated Critical by Adobe, and six of the eight don’t require authentication to exploit:
| CVE | Category | Impact | CVSS | Auth required? | Notes |
|---|---|---|---|---|---|
| CVE-2026-76200 | Stored XSS | Privilege escalation | 9.3 | No | |
| CVE-2026-76201 | Stored XSS | Privilege escalation | 9.3 | No | |
| CVE-2026-77111 | Incorrect Authorization | Security feature bypass | 8.7 | Yes | |
| CVE-2026-77109 | Incorrect Authorization | Privilege escalation | 8.6 | No | B2B |
| CVE-2026-77774 | Incorrect Authorization | Security feature bypass | 8.6 | No | |
| CVE-2026-76202 | Incorrect Authorization | Privilege escalation | 8.2 | No | |
| CVE-2026-77110 | Path Traversal | Security feature bypass | 7.6 | Yes | |
| CVE-2026-77108 | Incorrect Authorization | Privilege escalation | 7.5 | No | B2B |
Two (CVE-2026-77109 and CVE-2026-77108) are specific to Adobe Commerce B2B; the rest apply broadly.
Is This as Urgent as StyleSmuggler?
Not in the sense that matters most: Adobe has no evidence any of these 8 CVEs are being actively exploited, unlike StyleSmuggler, which was already under real attack before a patch existed. This is a proactive, responsible-disclosure release, not an emergency response.
But don’t read “not actively exploited” as “low priority” — two of these are 9.3, and six of the eight need no authentication at all to exploit. That’s a severity profile worth treating with real urgency in your own patching schedule, even without an active-attack headline attached to it. The gap between “critical and unauthenticated” and “actively exploited” tends to close the moment a patch reveals what the vulnerable code path looks like — attackers routinely reverse-engineer patches to build exploits for exactly this reason.
Does the StyleSmuggler Patch Cover This Too?
No — and this is the part worth double-checking even if you already patched StyleSmuggler. These are two separate Adobe releases. The VULN-39341 hotfix from APSB26-146 addresses only the StyleSmuggler RCE; it does not include the 8 fixes in APSB26-138, and applying the September release doesn’t retroactively include VULN-39341 either. If you’ve only applied one, you need the other too.
What Should You Do?
- Apply the September 2026 release for your version train (e.g.
2.4.9-2026-sep), or use Adobe’s monthly Isolated Patch option if you don’t want a full version bump right now - Separately confirm the VULN-39341 StyleSmuggler hotfix is applied — the two are independent, and this bulletin does not include it
- Use Adobe’s Commerce Version Tool to verify both patches are actually active rather than assuming a deploy succeeded
- Affected versions span Adobe Commerce and Magento Open Source 2.4.4 through 2.4.9, plus Adobe Commerce B2B 1.3.3 through 1.5.3 — don’t assume an older branch is out of scope without checking
If you’re not sure whether both patches are correctly applied across your stores, that’s exactly what our technical support service is for — a quick verification pass now is a lot cheaper than finding out later that one of the two was missed.
