1.0 Introduction
Adobe
has released critical security updates to address multiple vulnerabilities in
Adobe Commerce and Magento Open Source.
2.0 Impact
Successful
exploitation of this vulnerability may allow a remote, unauthenticated
attacker, without user interaction or administrative privileges, to switch a
customer session to another customer’s account. This may lead to privilege
escalation, account takeover, and unauthorised access to private customer data.
3.0 Affected Product
·
Adobe Commerce: 2.4.9-2026-jul,
2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul
and earlier
·
Adobe Commerce B2B: 1.5.3-2026-jul,
1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul and earlier
·
Magento Open Source: 2.4.9-2026-jul,
2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul and earlier
4.0 Recommendations
CyberSecurity Malaysia encourages users and administrators to review
the Adobe
Security Bulletin APSB26-92 and apply the necessary updates.
Kindly refer to the following URL: https://www.adobe.com/trust/security/products/commerce/apsb26-92.html
Generally, we advise users to be updated with the latest
security announcements by the vendor and follow best practice security policies
to determine which updates should be applied.
For further enquiries, please contact Cyber999 Incident
Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my
5.0 References