APSB26-73: Adobe's July Patch Isn't One You Schedule for Later

On July 14, Adobe published APSB26-73 — a security bulletin covering 13 CVEs across Adobe Commerce, Magento Open Source, Commerce B2B, and Commerce Events, eight of them rated Critical. If you run any of those on a supported branch, this is the week to patch, not the week to add it to next sprint's backlog.

This isn't a routine maintenance release. It's the kind of bulletin that ends up in a "why did we sit on this" postmortem when a store gets popped three weeks after the fix went public. Here's what's actually in it, who's affected, and the staging-first process that keeps you off that list.

01What's actually in the bulletin

Strip away the CVE numbers and the bulletin breaks down into a handful of vulnerability categories. The combination is what makes this one dangerous rather than merely annoying:

None of these is exotic on its own. What should worry you is that they chain. Picture the realistic path: an authorization bypass gets an attacker into a corner of the admin they shouldn't reach, a stored XSS in that same area gives them a script that runs with a real admin's session, and the file-upload flaw lands a web shell on the server. Three "Critical" line items in a bulletin turn into one fully compromised store — customer data, payment configuration, and whatever extension code is running in production, all in reach.

02Who's in scope (almost everyone)

The affected version list is wide enough that most supported stores are on it:

Unless you're already running a build released after July 14, assume you're in scope until you've confirmed otherwise. Checking takes thirty seconds:

# Check your installed version
bin/magento --version

# Or check the constraint in your Composer manifest
grep "product-community-edition\|product-enterprise-edition" composer.json

If it matches anything on that list, this bulletin is about your store — not a general industry FYI.

03The "Priority 2, no known exploits" nuance

Adobe rates this a Priority 2, and as of publication there's no report of active exploitation. That sounds like room to breathe. It isn't, for two reasons.

Treat the window Adobe gives you as a countdown, not a grace period.

04The patch is free. The QA is what costs you.

Here's the part that actually matters operationally: applying Adobe's isolated patch takes minutes. Adobe ships it specifically so you don't have to do a full version upgrade to get the fix — but it's also only tested against the latest security-only release for your line, which means you need to be current on your -p patch level before it even applies cleanly.

That's not where the real work is, though. The real work is proving that nothing else broke. On a store with any meaningful amount of customization, don't apply this straight to production.

Pull the isolated patch into a staging environment that mirrors production, not a bare-bones test box.

Checkout, payment methods, admin workflows — anything touching the modules named in the bulletin (upload handlers, webhooks, admin auth, backend forms).

Especially anything that touches file upload, webhooks, or admin authorization — the exact surface this bulletin patches.

Only after staging comes back clean. Not before.

05Why this gets harder the more patched-over your store is

This is where technical debt turns a same-day fix into a multi-week fire drill. Every core override, every forked vendor module, every unaudited third-party extension is one more place the isolated patch might not apply cleanly, or one more place a regression can hide. Stores built on clean Composer installs with no core overrides sail through cycles like this. Stores held together with patched-over patches don't.

If you're an agency managing this patch across a dozen client stores, the math is worse: a messy install on any one of them turns a Tuesday afternoon into a week of client calls. Worth an hour now to check which of your stores are running clean installs versus which ones have core overrides nobody remembers writing.

06Frequently asked questions

Reference: Adobe Security Bulletin APSB26-73 · Adobe Commerce Knowledge Base guidance