Magento Open Source, Adobe Commerce B2B: separate content from scripts

Published · Updated · APIs and connected services · 6 min read · By Cyber Intelligence Embassy

At a glance

Magento Open Source, Adobe Commerce B2B: cross-site scripting (XSS). This 2026-10-14 case examines 19 version entries and 44 CVEs, documented releases and checks suited to runtime platforms, using CERTFR-2026-AVI-1301.

AI illustration: a dark cybersecurity technology space with restrained golden lighting Illustration · fictional scene
In this article

Retrospective for 2026-10-14, compiled on 27 October 2026. The date identifies the day being analysed; source publication and revision dates are recorded below.

What this advisory changes in your environment

The starting point is CERTFR-2026-AVI-1301, published on 2026-10-14. Its scope includes Magento Open Source, Adobe Commerce B2B, ColdFusion 2025, Adobe Commerce, ColdFusion 2023. Reported consequences are denial of service, cross-site scripting (XSS), remote code execution, data integrity compromise, security control bypass, loss of confidentiality, privilege escalation. These statements apply to the advisory’s scope; they do not assign every consequence to every product or CVE.

This case contains 19 version entries; CVE identifier count: 44. Track remediation by component: a successful overall update does not demonstrate that Magento Open Source and ColdFusion 2023 each received their respective fix.

Products and versions to examine

Reference
CERTFR-2026-AVI-1301
Source first published
2026-10-14
Latest source revision available for this day
2026-10-14
Named components
Magento Open Source, Adobe Commerce B2B, ColdFusion 2025, Adobe Commerce, ColdFusion 2023
CVE identifiers
CVE-2026-71385, CVE-2026-92911, CVE-2026-95631, CVE-2026-76001, CVE-2026-106617, CVE-2026-105900, CVE-2026-92464, CVE-2026-90530, CVE-2026-95630, CVE-2026-105898, CVE-2026-75650, CVE-2026-106614, CVE-2026-106090, CVE-2026-106620, CVE-2026-91013, CVE-2026-106089, CVE-2026-106621, CVE-2026-75994, CVE-2026-105903, CVE-2026-75748, CVE-2026-106618, CVE-2026-92922, CVE-2026-92909, CVE-2026-75995 … (+20)
ComponentPublished condition
Magento Open Source2.4.9-x : < 2.4.9-2026-oct
Adobe Commerce B2B1.4.2-x : < 1.4.2-2026-oct
Adobe Commerce B2B1.5.3-x : < 1.5.3-2026-oct
ColdFusion 2025< 2025.0.14
Adobe Commerce2.4.7-x : < 2.4.7-2026-oct
Magento Open Source2.4.8-x : < 2.4.8-2026-oct
Adobe Commerce2.4.10-x : < 2.4.10-alpha1
Adobe Commerce B2B1.3.4-x : < 1.3.4-2026-oct
Magento Open Source2.4.7-x : < 2.4.7-2026-oct
ColdFusion 2023< 2023.0.26
Adobe Commerce2.4.6-x : < 2.4.6-2026-oct
Adobe Commerce B2B1.5.2-x : < 1.5.2-2026-oct
Adobe Commerce2.4.8-x : < 2.4.8-2026-oct
Adobe Commerce B2B1.3.3-x : < 1.3.3-2026-oct
Adobe Commerce2.4.4-x : < 2.4.4-2026-oct
Adobe Commerce2.4.5-x : < 2.4.5-2026-oct
Magento Open Source2.4.10-x : < 2.4.10-alpha1
Adobe Commerce B2B1.5.4-x : < 1.5.4-alpha1
Adobe Commerce2.4.9-x : < 2.4.9-2026-oct

For Magento Open Source, the published condition is “2.4.9-x : < 2.4.9-2026-oct”. Compare the version actually loaded with that condition within its own release branch. A fix installed on another edition of Magento Open Source, Adobe Commerce B2B does not close this case.

Mechanism and prerequisites

XSS abuses the trust a browser places in a page. Inspect untrusted content rendering, administrative sessions and output controls; input filtering alone does not establish that executable scripts are impossible.

The primary record CVE-2026-106622, published by adobe, covers ColdFusion 2025, ColdFusion 2023. The retained revision is dated 2026-10-14. Its scope is presented separately from the integrations and product groupings in CERTFR-2026-AVI-1301.

The published metric for CVE-2026-106622 is CVSS 3.1, 10/10. The vector below describes technical prerequisites; it does not measure attack frequency or the likelihood that your deployment is compromised.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack vector
network
Prior privileges
none
User interaction
none
Complexity
low
Weakness
CWE-918

Choose the appropriate intervention

  1. Locate Magento Open Source instances, running releases and service owners. Record condition 2.4.9-x : < 2.4.9-2026-oct in the ticket alongside reference CERTFR-2026-AVI-1301.
  2. Compare the installed branch with the vendor’s Magento Open Source release notes. Prepare the package for that branch and a dependent-service test, retaining the pre-change state.
  3. After changing Magento Open Source, capture the loaded version again and verify the workflow below. Any exception needs an owner, an exposure-reduction measure and an expiry date.

Verify the fix in a real workflow

Validation scenario to adapt for Magento Open Source, Adobe Commerce B2B: For Magento Open Source, capture the version loaded by the process or active kernel, then restart only as required by maintenance instructions. Check a dependent workflow and look for embedded copies in distributed images or executables. This is a proposed defensive check, not a claim that testing was performed against third-party systems.

Limit of case CERTFR-2026-AVI-1301: this analysis replaces neither vendor prerequisites nor investigation of your logs. Only documented versions are reproduced; no attack date or victim is invented.

Questions specific to this case

Which condition should be checked for Magento Open Source?

Advisory CERTFR-2026-AVI-1301 states: Magento Open Source — 2.4.9-x : < 2.4.9-2026-oct. Check the edition and running release; do not extend the published boundary to branches absent from the advisory.

Why not use one fix for Magento Open Source and ColdFusion 2023?

CERTFR-2026-AVI-1301 distinguishes these components within a scope containing 19 entries. Match each branch to its own update documentation and functional check.

Which prerequisites does record CVE-2026-106622 specify?

For CVE-2026-106622, the published vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Verify those conditions on ColdFusion 2025, ColdFusion 2023 before applying them to an integration named in CERTFR-2026-AVI-1301.

Sources and related reading

Practical guide : Prioritize vulnerabilities and verify remediation

Explore the decision addressed in this case

Complete source advisory inventory

The article table may be an extract. These lists contain every affected-system entry and CVE in the specified advisory revision. They are not an inventory of your assets and do not map every CVE to every product.

Official source · CERTFR-2026-AVI-1301
Advisory revision : · Checked on :

Affected systems · 19

Original French wording is retained to avoid ambiguous translations of version conditions.

  1. Magento Open Source versions 2.4.9-x antérieures à 2.4.9-2026-oct
  2. Adobe Commerce B2B versions 1.4.2-x antérieures à 1.4.2-2026-oct
  3. Adobe Commerce B2B versions 1.5.3-x antérieures à 1.5.3-2026-oct
  4. ColdFusion 2025 versions antérieures à 2025.0.14
  5. Adobe Commerce versions 2.4.7-x antérieures à 2.4.7-2026-oct
  6. Magento Open Source versions 2.4.8-x antérieures à 2.4.8-2026-oct
  7. Adobe Commerce versions 2.4.10-x antérieures à 2.4.10-alpha1
  8. Adobe Commerce B2B versions 1.3.4-x antérieures à 1.3.4-2026-oct
  9. Magento Open Source versions 2.4.7-x antérieures à 2.4.7-2026-oct
  10. ColdFusion 2023 versions antérieures à 2023.0.26
  11. Adobe Commerce versions 2.4.6-x antérieures à 2.4.6-2026-oct
  12. Adobe Commerce B2B versions 1.5.2-x antérieures à 1.5.2-2026-oct
  13. Adobe Commerce versions 2.4.8-x antérieures à 2.4.8-2026-oct
  14. Adobe Commerce B2B versions 1.3.3-x antérieures à 1.3.3-2026-oct
  15. Adobe Commerce versions 2.4.4-x antérieures à 2.4.4-2026-oct
  16. Adobe Commerce versions 2.4.5-x antérieures à 2.4.5-2026-oct
  17. Magento Open Source versions 2.4.10-x antérieures à 2.4.10-alpha1
  18. Adobe Commerce B2B versions 1.5.4-x antérieures à 1.5.4-alpha1
  19. Adobe Commerce versions 2.4.9-x antérieures à 2.4.9-2026-oct
CVE identifiers · 44