Adobe announced on June 10, 2025 the availability of a critical security update for the platforms Adobe Commerce and Magento Open Source, according to Security Bulletin APSB25-50. The update addresses vulnerabilities that, if exploited, could lead to bypassing security mechanisms, escalation of privileges and arbitrary code execution.
Affected Versions
Adobe Commerce:
- 2.4.8
- 2.4.7-p5 and older
- 2.4.6-p10 and older
- 2.4.5-p12 and older
- 2.4.4-p13 and older
Adobe Commerce B2B:
- 1.5.2 and older
Magento Open Source:
- 2.4.8
- 2.4.7-p5 and older
- 2.4.6-p10 and older
- 2.4.5-p12 and older
Risks & Vulnerabilities
The main vulnerabilities being patched include:
| CVE | Description | Seriousness | Access Level |
|---|---|---|---|
| CVE-2025-47110 | Reflected XSS (execution of arbitrary code) | Critical (9.1) | Requires admin |
| CVE-2025-43585 | Improper Authorization | Critical (8.2) | Without authentication |
| CVE-2025-27206 | Improper Access Control | Significant (5.3) | Requires admin |
| CVE-2025-27207 | Privilege Escalation (B2B) | Significant (6.5) | Requires user |
| CVE-2025-43586 | Privilege Escalation (B2B) | Significant (6.5) | Requires user |
No exploits have been reported yet. “in the wild”, however Adobe recommends immediate upgrade.
Recommended Updates
Adobe recommends the following versions depending on your existing installation:
| Current Version | Upgrade To |
|---|---|
| 2.4.8 | 2.4.8-p1 or 2.4.9-alpha1 |
| 2.4.7-p5 and older | 2.4.7-p6 |
| 2.4.6-p10 and older | 2.4.6-p11 |
| 2.4.5-p12 and older | 2.4.5-p13 |
| 2.4.4-p13 and older | 2.4.4-p14 |
For B2B installations:
| Current B2B Version | Upgrade To |
|---|---|
| 1.5.2 | 1.5.2-p1 or 1.5.3-alpha1 |
| 1.4.2-p5 and older | 1.4.2-p6 |
| 1.3.4-p12 and older | 1.3.4-p13 |
In addition, it is available isolated patch for CVE-2025-47110.
How to proceed with the update
The upgrade can be done via Composer. Example:
composer require magento/product-community-edition 2.4.8-p1 --no-update composer update bin/magento setup:upgrade bin/magento cache:flush
Alternatively, consult the official Adobe installation instructions or contact your e-shop administrator.
Immediate implementation of the updates is strongly recommended, especially for stores with increased transaction volume or sensitive customer data.
For any help or advice regarding Magento update, please feel free to contact with us.