CVE-2026-77774: Magento still needs APSB26-138 after the StyleSmuggler hotfix

If you applied Adobe's StyleSmuggler hotfix yesterday and stopped there, Adobe Commerce and Magento Open Source still carry a separate September patch train. APSB26-138 (Priority 2, published September 8, 2026) closes eight Critical issues, including unauthenticated authorization bypasses and stored XSS that can escalate privileges. Adobe states it is not aware of exploitation for these issues. That is not the same as "the StyleSmuggler hotfix covered it."

The operator trap is explicit in Adobe's release notes: the APSB26-146 hotfix for CVE-2026-75650 is not bundled into the September Isolated patch. Apply the hotfix first, then the September Isolated files (or the matching cloud-patches update). Merchants who only rotated keys and closed GraphQL styles still need APSB26-138.

What broke

Adobe's bulletin lists eight CVEs. The ones that matter first for internet-facing stores:

• CVE-2026-77774 - Incorrect Authorization, Critical (CVSS 8.6). No authentication required. Security feature bypass with unauthorized read access. Scope changed.
• CVE-2026-76202 - Incorrect Authorization, Critical (CVSS 8.2). No authentication required. Privilege escalation with high confidentiality impact.
• CVE-2026-76200 and CVE-2026-76201 - Stored XSS, Critical (CVSS 9.3 each). No authentication required, but user interaction is required. Privilege escalation with changed scope.
• CVE-2026-77111 - Incorrect Authorization, Critical (CVSS 8.7). High privileges required. Write-side security feature bypass.
• CVE-2026-77110 - Path traversal, Critical (CVSS 7.6). High privileges required. Limited security feature bypass outside intended paths.
• CVE-2026-77109 and CVE-2026-77108 - Incorrect Authorization, Critical. Marked B2B in the bulletin. Privilege escalation on Adobe Commerce B2B lines.

Unlike StyleSmuggler, Adobe rates this bulletin Priority 2 and reports no known in-the-wild use. The damage modes are authz bypass and XSS-assisted privilege escalation, not unauthenticated template RCE.

Who is not in scope

• Stores that already installed the September 2026 security packages (*-2026-sep) or the matching September Isolated patch files for every installed component, and still have the APSB26-146 StyleSmuggler hotfix applied.
• Magento Open Source without Adobe Commerce B2B: CVE-2026-77109 and CVE-2026-77108 are B2B-scoped in APSB26-138.
• Adobe Campaign Classic OS command injection is a different product and bulletin (APSB26-142 / CVE-2026-82004), not this Magento train.
• High-privilege-only path traversal (CVE-2026-77110) and write bypass (CVE-2026-77111) are not unauthenticated storefront bugs; they still need the same September train.

One concrete check

From the Commerce project root, after the July 2026 Isolated patch that ships Commerce Version Tool:

php vendor/bin/patch-status

Read applied_patches, missing_patches, and per-CVE vulnerability_status. You want PROTECTED for CVE-2026-77774 (and the siblings below), not only for CVE-2026-75650. If CVT is missing, php vendor/bin/patch-status --version fails until the July Isolated file is present.

Cloud merchants who cannot run CVT can confirm a specific Isolated file with Quality Patches Tool, for example grepping the September CE file id for their line after it is applied.

How to fix

Upgrade Adobe Commerce / Magento Open Source to the September 2026 security builds, or apply the September Isolated patch files for your exact release line:

• Adobe Commerce: 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep
• Magento Open Source: 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep (Open Source Isolated downloads start at 2.4.7+)
• Adobe Commerce B2B: matching *-2026-sep lines in APSB26-138

Operational order from Adobe's FAQ:

1. Apply APSB26-146 / VULN-39341 StyleSmuggler hotfix if it is not already on the box (actively exploited; not included in the September Isolated zip).
2. Confirm August 2026 Isolated patches for your line are already applied. September builds on August.
3. Apply the September Isolated component files in CE → EE → B2B order when those components are installed, or take the cloud-patches path if Magento Cloud Patches already carries the fix.
4. Re-run php vendor/bin/patch-status and confirm the September CVE set shows PROTECTED.

Adobe is shipping these September fixes as Isolated patch files only (no Composer security packages for this drop). That is intentional for speed, but it means you cannot treat "composer update finished" as proof for APSB26-138.

What this is not

This is not another StyleSmuggler-class unauthenticated RCE advisory, and Adobe is not reporting active exploitation for APSB26-138. It is also not optional if you already hotfixed CVE-2026-75650: the September authz and XSS cluster is a second train.

References

• Adobe Security Bulletin APSB26-138
• September 2026 Isolated patch release notes (KA-44020)
• Adobe Security Bulletin APSB26-146 (StyleSmuggler)
• HOL Guard evidence packs: CVE-2026-77774, CVE-2026-76202, CVE-2026-76200