Advisory · CVE-2026-92464
Input validation flaw lets a privileged Adobe Commerce attacker run code
Adobe Commerce improperly validates input in a path a highly privileged attacker can use to execute arbitrary code with changed scope. Adobe rates it CVSS 3.1 9.1.
- Vendor
- Adobe
- Product
- Adobe Commerce
- Identifier / CWE
- CVE-2026-92464
CWE-20 - Action timing
- Immediate
Explain it like I’m five
An admin-level account can feed Commerce input it never properly checks, and the platform turns that input into running code.
- 01Privileged access
An attacker with high Commerce privileges reaches the vulnerable function.
- 02Unvalidated input
The attacker submits input the product fails to validate.
- 03Code executes
Commerce runs the attacker's code in its own context.
What happened
Adobe disclosed CVE-2026-92464 in bulletin APSB26-153. Improper input validation (CWE-20) in Adobe Commerce lets an attacker who already holds high privileges execute arbitrary code; exploitation needs no user interaction.
Adobe’s affected data covers Commerce and Magento Open Source release lines through the September 2026 updates, with the October 2026 updates listed as unaffected. Apply the APSB26-153 update for your release line.
What to do
- Inventory every Adobe Commerce deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Adobe Commerce while remediation is underway, especially for internet-facing instances.
- Review application and server logs for actions by privileged accounts outside normal workflows, new integrations or files, and unexpected server processes.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
The privilege bar limits exposure, but code execution from an admin account is how a single compromised credential becomes a full store compromise. Patch and audit admin accounts.